fc754efa1ccb9858f742b144fa81987a02140faf030efa781d64626114b87404

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 07:32

Target
26c35c913d9c9ede10a10d434b4f57fa_JaffaCakes118.dll
Size 346KB
Sample240705-jcx9kavblm
SHA256 fc754efa1ccb9858f742b144fa81987a02140faf030efa781d64626114b87404
MD5 26c35c913d9c9ede10a10d434b4f57fa
SHA1 02fef590c67b9aba9c342f124c3089454e1763a6
SHA512 1def6a544c3e748286e7a7780ac91e9c5f7e8c370dce6a5b942a325c3546443262fbdc846457c1aef47b7eb00ab70f0c74460f2b35c17721e9ac7e251ff81e21
SSDEEP 3072:c82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYR8r3:32L7HN7Kl/jLA90QECrYR63
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1604	5048	rundll32.exe	81
PID 5048 wrote to memory of 1604	5048	rundll32.exe	81
PID 5048 wrote to memory of 1604	5048	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26c35c913d9c9ede10a10d434b4f57fa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26c35c913d9c9ede10a10d434b4f57fa_JaffaCakes118.dll,#1
  2⤵
  PID:1604