29f140fc41ceb2cd56d3ddf5d29e97628398c3e9080dc81a4056705a006b5cbb

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 12:09

Target
2c4ada2b6789145e12cc2a855c96a7a1_JaffaCakes118.dll
Size 340KB
Sample240708-pbt4eayarr
SHA256 29f140fc41ceb2cd56d3ddf5d29e97628398c3e9080dc81a4056705a006b5cbb
MD5 2c4ada2b6789145e12cc2a855c96a7a1
SHA1 b1922f07579002b9fb02d93aef84c7c4a0be9d45
SHA512 fa5f73e851a00fb173510be51affaffedb85b1d590c1a0ac894737ef1ba5a5fc3fd1f2f776c3ceed012992f18670565e75688675b3c270366932fda441d0d00b
SSDEEP 3072:7vA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXRca:7206xWgGxLxWN40PDKR/JnXya
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3832	4376	rundll32.exe	82
PID 4376 wrote to memory of 3832	4376	rundll32.exe	82
PID 4376 wrote to memory of 3832	4376	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c4ada2b6789145e12cc2a855c96a7a1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c4ada2b6789145e12cc2a855c96a7a1_JaffaCakes118.dll,#1
  2⤵
  PID:3832