0009f9789f0b3fd20e9a2c48ab36bbca322cdf050fc8d3ebe7e12b470a0e4551

Analysis

max time kernel
95s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 16:56

Target
a69c31b0b86f43c7f7bf7a45d22f246f_JaffaCakes118.dll
Size 78KB
Sample240613-vfpbls1dkj
SHA256 0009f9789f0b3fd20e9a2c48ab36bbca322cdf050fc8d3ebe7e12b470a0e4551
MD5 a69c31b0b86f43c7f7bf7a45d22f246f
SHA1 fee2512bde91765be267d54ee0c6af1f4eaa0555
SHA512 66fb50e5f80e1da703a4287fb61b417635eccc23ba9a21088c60104c9e3d76a322264a9fc13fcc623b5a3f4e4d8f389412252909170b1f7d5624a1d331dc9e06
SSDEEP 1536:rq3vKpdUQ5hHhjF9Smvu8W7hW1VvXANksSTiO6NDIC3:rwSJhBo8oW3vXAhSTh6NDj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 4188	2312	rundll32.exe	81
PID 2312 wrote to memory of 4188	2312	rundll32.exe	81
PID 2312 wrote to memory of 4188	2312	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a69c31b0b86f43c7f7bf7a45d22f246f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a69c31b0b86f43c7f7bf7a45d22f246f_JaffaCakes118.dll,#1
  2⤵
  PID:4188