0dc44a80e9c4dd5dd844d2aae38b49c5ccb76c86abaab35f17d6a27f4590e967

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 03:51

Target
4015dedd78ef29283909c7f3109b5b8b_JaffaCakes118.dll
Size 346KB
Sample240713-eekzssxapd
SHA256 0dc44a80e9c4dd5dd844d2aae38b49c5ccb76c86abaab35f17d6a27f4590e967
MD5 4015dedd78ef29283909c7f3109b5b8b
SHA1 29f99d370e04c98b0b59c9c050ebf25bdfcb5404
SHA512 90ae4242b085c904d8c574149926432ba91f31f540fba368ecca6507386d2522ea2fd4f20b67bfadb1357b41f20f39a304835924a529bad2e51bedad92bd3001
SSDEEP 3072:c82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:32L7HN7Kl/jLA90QECrYRpj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 1152	3400	rundll32.exe	83
PID 3400 wrote to memory of 1152	3400	rundll32.exe	83
PID 3400 wrote to memory of 1152	3400	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4015dedd78ef29283909c7f3109b5b8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4015dedd78ef29283909c7f3109b5b8b_JaffaCakes118.dll,#1
  2⤵
  PID:1152