919c95161b6e528ff970cffb8ecee4199aed09f86d575b510fbda6e90f7e566a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 03:48

Target
4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118.dll
Size 34KB
Sample240713-eczp6svanm
SHA256 919c95161b6e528ff970cffb8ecee4199aed09f86d575b510fbda6e90f7e566a
MD5 4013dc0bad3c5043e7f642560a15b4c4
SHA1 42597c7da258a4da5a0c75bf6f228d286c0640bf
SHA512 c55b91388ac164bde9b63d60b530c4fa564c0c5e18b362f7a673f384a5bb82b6e1088ae05302c7129df2d0b645a1572c8a3923ac30d92ff211cb6c61b30cc24d
SSDEEP 768:AlOTjhcY4591BlnONd7hFyDhChw59FR6Cjf:AlOTL45jy7hF4M6XFR6Cj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4416	3792	rundll32.exe	82
PID 3792 wrote to memory of 4416	3792	rundll32.exe	82
PID 3792 wrote to memory of 4416	3792	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4013dc0bad3c5043e7f642560a15b4c4_JaffaCakes118.dll,#1
  2⤵
  PID:4416