7897f07ca1f507a18172bbf1c09c44d42012c587c12ffab2230d85b4f6e3decd

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 16:03

Target
310afae66cc4286412c691fcdd1c14f8_JaffaCakes118.dll
Size 340KB
Sample240709-thjcps1gnq
SHA256 7897f07ca1f507a18172bbf1c09c44d42012c587c12ffab2230d85b4f6e3decd
MD5 310afae66cc4286412c691fcdd1c14f8
SHA1 71750105953dd568027d5612585e909c9b9bca47
SHA512 700970d1a4d94bc0b98b75c4a2ca3a728c22a1999ee35affcef880dba174408ea6bf37eaf1c6f50858afbaa774160be8b1c08b4c07f438a16f9ecfb7cfe6764e
SSDEEP 3072:ZvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:Z206xWgGxLxWN40PDKR/JnX2P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 640	4024	rundll32.exe	82
PID 4024 wrote to memory of 640	4024	rundll32.exe	82
PID 4024 wrote to memory of 640	4024	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\310afae66cc4286412c691fcdd1c14f8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\310afae66cc4286412c691fcdd1c14f8_JaffaCakes118.dll,#1
  2⤵
  PID:640