cf99767a7fa958c313a134f5bc9b91b45a75ff70e68a0a3583b365597267c827

Analysis

max time kernel
129s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 03:34

Target
18a2c170d1bac142fb628b52ee491d06_JaffaCakes118.dll
Size 32KB
Sample240628-d45vts1hrj
SHA256 cf99767a7fa958c313a134f5bc9b91b45a75ff70e68a0a3583b365597267c827
MD5 18a2c170d1bac142fb628b52ee491d06
SHA1 f0a5e09419bd9620026ac0920372521e119efa5d
SHA512 2a06fb2148368bff1363902c61720a289adbca3bc569f32ebeaccbcfc099f3f49496568faeafe5e7dc198f90c1db72add6203ce9f9c69cfdda03d363f3f299d1
SSDEEP 768:ID1/bMP6LQtyBupFI7xf37/A/xIShVDDRk63k/K:S1/bMP6kAuQ1f7/AbHPRWy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3976	2540	rundll32.exe	83
PID 2540 wrote to memory of 3976	2540	rundll32.exe	83
PID 2540 wrote to memory of 3976	2540	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18a2c170d1bac142fb628b52ee491d06_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18a2c170d1bac142fb628b52ee491d06_JaffaCakes118.dll,#1
  2⤵
  PID:3976