90650669debda7c87777700305c958571cb7d13318049a9eb6529531600a1f32

Analysis

max time kernel
62s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 11:16

Target
a53f93b49f0c89a8bb62e3d66d3f2c6c_JaffaCakes118.dll
Size 50KB
Sample240613-ndeaaszhjp
SHA256 90650669debda7c87777700305c958571cb7d13318049a9eb6529531600a1f32
MD5 a53f93b49f0c89a8bb62e3d66d3f2c6c
SHA1 0d5a3b17eebdec05cb44db2bcde3b32b54d62515
SHA512 e18fc2b4d4b602e3328cfa7f77ec8917afb03820d31166f02a0e9ce92d61063fdd5ea5720887dca0effe9b716bcddc889c5552fb2ac02282f53a9ccad606ee25
SSDEEP 768:pyWPlCXviXqJVXJ53Smel5fTxxWf6oycvMUUZ0asitmx:pyclCXviuxg51eP5Y2itmx
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1148	1340	rundll32.exe	82
PID 1340 wrote to memory of 1148	1340	rundll32.exe	82
PID 1340 wrote to memory of 1148	1340	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a53f93b49f0c89a8bb62e3d66d3f2c6c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a53f93b49f0c89a8bb62e3d66d3f2c6c_JaffaCakes118.dll,#1
  2⤵
  PID:1148