7465d3b3ed891f81e5796eea72c687cf917ecc05e1214ac52b64410dfc715da0

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 16:53

Target
428bb557992eec529229e5ed0d17688f_JaffaCakes118.dll
Size 346KB
Sample240713-vedhqa1eqa
SHA256 7465d3b3ed891f81e5796eea72c687cf917ecc05e1214ac52b64410dfc715da0
MD5 428bb557992eec529229e5ed0d17688f
SHA1 92a0693a72ced9eefff7d7fbaa29de49bf02e4f9
SHA512 4c10bb1c0b788ee84380c97835628826ad01e82e877816b17b17ad5e054f3f08c59306e6ea753c07df2db54fb4fdbaa2af33fa2b5020ddfb06dd41cfdf6baf31
SSDEEP 3072:L82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYR8r3:I2L7HN7Kl/jLA90QECrYR63
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4604	3040	rundll32.exe	83
PID 3040 wrote to memory of 4604	3040	rundll32.exe	83
PID 3040 wrote to memory of 4604	3040	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\428bb557992eec529229e5ed0d17688f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\428bb557992eec529229e5ed0d17688f_JaffaCakes118.dll,#1
  2⤵
  PID:4604