b34de63c516fbfbb1669d95527de8f0d1e0e970d1397c2d329f5dc7135f5bdd7

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 13:28

Target
1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118.dll
Size 64KB
Sample240628-qq43lasamf
SHA256 b34de63c516fbfbb1669d95527de8f0d1e0e970d1397c2d329f5dc7135f5bdd7
MD5 1a4c451fab318cee6c4f8e6027f6cdf7
SHA1 d1516af58a89fe8d59e136bb0801d5bc53ea4f88
SHA512 52dba9624aa43f8f47b0d2a5191efb1786fd7129bbf9aded70ba2c6bee66bcfc3bdf960f64f70b1bde43279986e3e758458061d02a600d3a9607c1cc047615c4
SSDEEP 1536:BfHt9IKlLgTETKVS/gl+KRBgeKfhnr0lO7:B2Q/SBg3fhn4l6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3960	2180	rundll32.exe	80
PID 2180 wrote to memory of 3960	2180	rundll32.exe	80
PID 2180 wrote to memory of 3960	2180	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a4c451fab318cee6c4f8e6027f6cdf7_JaffaCakes118.dll,#1
  2⤵
  PID:3960