443bd78057b8d2f87cb1015485ab446793e051703665964fe6c86f41b8ba6c54

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 12:40

Target
2c61154ce27736c00146b7f142e913c9_JaffaCakes118.dll
Size 340KB
Sample240708-pv673ssajd
SHA256 443bd78057b8d2f87cb1015485ab446793e051703665964fe6c86f41b8ba6c54
MD5 2c61154ce27736c00146b7f142e913c9
SHA1 d441a2720f01f62e87d3582d2cafc4107cf50e4c
SHA512 11e19fc567f7b0459354d1549ac30ad671a75e53c5933c1a674e9f2363d80e79613f6ad9608180905d3c85483d1438e572bc33c47c3181b4c2e0525581e6c04f
SSDEEP 3072:tvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:t206xWgGxLxWN40PDKR/JnX2P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2248	2276	rundll32.exe	82
PID 2276 wrote to memory of 2248	2276	rundll32.exe	82
PID 2276 wrote to memory of 2248	2276	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c61154ce27736c00146b7f142e913c9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c61154ce27736c00146b7f142e913c9_JaffaCakes118.dll,#1
  2⤵
  PID:2248