fc11839e50de13a1d9f9a0491aaff391bb71e6cc8536520f9ca19e8f2c12ecc3

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 23:07

Target
325b06c14997a113f330573bf22687bd_JaffaCakes118.dll
Size 330KB
Sample240709-237j2atapc
SHA256 fc11839e50de13a1d9f9a0491aaff391bb71e6cc8536520f9ca19e8f2c12ecc3
MD5 325b06c14997a113f330573bf22687bd
SHA1 0da63c10ce90d84eafdf8ffdd62d76a1a9f09d89
SHA512 390fae394af5101b377ca63e79feed848f37a3ed59a0fbc92e5dabfdef486777efc4a6b9226da8c0e9220d9149a04790c63d6c8b8c14dde0f00457a6fd782a1f
SSDEEP 3072:URq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:Gq1sFAwgwmBv3wnIgG4oAYxvU54eu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2484	1088	rundll32.exe	81
PID 1088 wrote to memory of 2484	1088	rundll32.exe	81
PID 1088 wrote to memory of 2484	1088	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\325b06c14997a113f330573bf22687bd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\325b06c14997a113f330573bf22687bd_JaffaCakes118.dll,#1
  2⤵
  PID:2484