8a8f52e8f8ca6c35ec464ec7b58397f69ebc817d2427dbd2cf01c55f00ea875a

Analysis

max time kernel
145s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 23:41

Target
23e1bbdc9ee4ad68cc6e0dc9677b1222_JaffaCakes118.dll
Size 346KB
Sample240703-3pspdssdll
SHA256 8a8f52e8f8ca6c35ec464ec7b58397f69ebc817d2427dbd2cf01c55f00ea875a
MD5 23e1bbdc9ee4ad68cc6e0dc9677b1222
SHA1 c35abf0677ae04ba83cb62643ff2ff26446020a9
SHA512 b63244933b817dbf7999801b1b9ecb34da399fe84a5a8548833cb654c336a9db3411c6556455d008a2bf4886465cdc4fd65660eeef955d2cdb07a2444fdd5610
SSDEEP 3072:e82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:t2L7HN7Kl/jLA90QECrYRpj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2700	4676	rundll32.exe	81
PID 4676 wrote to memory of 2700	4676	rundll32.exe	81
PID 4676 wrote to memory of 2700	4676	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23e1bbdc9ee4ad68cc6e0dc9677b1222_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23e1bbdc9ee4ad68cc6e0dc9677b1222_JaffaCakes118.dll,#1
  2⤵
  PID:2700