9ad3583d12a5950a05d31c3cf9baee869dd1738ce3e6fbb07950ec040e839a50

Analysis

max time kernel
148s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 18:14

Target
35d5716a2bcd4260c946bb19a9fe7a0e_JaffaCakes118.dll
Size 330KB
Sample240710-wvcf2avdkh
SHA256 9ad3583d12a5950a05d31c3cf9baee869dd1738ce3e6fbb07950ec040e839a50
MD5 35d5716a2bcd4260c946bb19a9fe7a0e
SHA1 44a0e9a75e04ea2b678832584d5999094fab28d1
SHA512 a2320ac93a470dd9a93dbe710a5e081f0f10b87dc0b2eec593055f84d4ad0c8c07079000ad9b0b35d218458e074d2f801f79d7dbdf403eaadca843e3899da304
SSDEEP 3072:JRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:rq1sFAwgwmBv3wnIgG4oAYxvU54eu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1492	4972	rundll32.exe	82
PID 4972 wrote to memory of 1492	4972	rundll32.exe	82
PID 4972 wrote to memory of 1492	4972	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35d5716a2bcd4260c946bb19a9fe7a0e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35d5716a2bcd4260c946bb19a9fe7a0e_JaffaCakes118.dll,#1
  2⤵
  PID:1492