c30c41b279ffea14b4df02f597b9acb37190ee707e92586d716ffae1267f79ea

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 01:04

Target
141f1868f44ea60a617b266f43514737_JaffaCakes118.dll
Size 398KB
Sample240627-bfa97sxalm
SHA256 c30c41b279ffea14b4df02f597b9acb37190ee707e92586d716ffae1267f79ea
MD5 141f1868f44ea60a617b266f43514737
SHA1 d2453478e8d1b2083a0bacf563fbd508ee43f982
SHA512 21da15c3bcfa36dad53b554927fc373eb937ebf51733d53747ef5fcc1078c36966500eab6ea06071b2798a73d9ca1886c277317dc73a3c623e440756cdc5ac1b
SSDEEP 6144:phlE9IW+WQyKL8ze3i8VGTfLAfgMii/Q6tby:3HmP2bVE4FY6tby
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 912	4904	rundll32.exe	80
PID 4904 wrote to memory of 912	4904	rundll32.exe	80
PID 4904 wrote to memory of 912	4904	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\141f1868f44ea60a617b266f43514737_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\141f1868f44ea60a617b266f43514737_JaffaCakes118.dll,#1
  2⤵
  PID:912

memory/912-0-0x0000000074B60000-0x0000000074BC8000-memory.dmp

Download