04c96b217ce5d78f2336e0eeebecd3c41f592040e2eec2339697159d1b1dc411

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:27

Target
a4a0d437ddc408a35f75fa501d192cb1_JaffaCakes118.dll
Size 839KB
Sample240613-kclffa1cqa
SHA256 04c96b217ce5d78f2336e0eeebecd3c41f592040e2eec2339697159d1b1dc411
MD5 a4a0d437ddc408a35f75fa501d192cb1
SHA1 d4094df7a432a07d10254fc6547a5bac7be9827d
SHA512 47326d17a4b3a0ea4f4a1b6a69b9a48021355b79729454f9ce4a81d013f7eeb71fcf8f20cd08446eac4945fa3bfdb3b75b520c81bc39db295727caa565bb0623
SSDEEP 12288:xd9dR8Qc/1VDWhXcJQY6ym9WGS+geWi6+Oo4l2+lDOKDLAnzsZ+HtRsAN:xdl8QiDWxcF6irRRWOo4MY3Azf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1232	1012	rundll32.exe	81
PID 1012 wrote to memory of 1232	1012	rundll32.exe	81
PID 1012 wrote to memory of 1232	1012	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4a0d437ddc408a35f75fa501d192cb1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4a0d437ddc408a35f75fa501d192cb1_JaffaCakes118.dll,#1
  2⤵
  PID:1232