9e9742ff75b2c01bc1cd6f0fb1953f89f58f78a04ff8062fdb30b5624bcfb0fe

Analysis

max time kernel
94s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 22:41

Target
505b53effc6c2c6fde39e1d2de03f977_JaffaCakes118.dll
Size 346KB
Sample240716-2l6amswgnf
SHA256 9e9742ff75b2c01bc1cd6f0fb1953f89f58f78a04ff8062fdb30b5624bcfb0fe
MD5 505b53effc6c2c6fde39e1d2de03f977
SHA1 881c26206397ba996f48cd50525b4d8dc5d9c969
SHA512 0aeba177d37f8f2ed97f76783e7ee2498e6e55e63cd68871ea541abadff05e7ec98b6f944a25df091cac05920b8b2727ce6c7252efca835bbe9b9d99ea3ced00
SSDEEP 3072:J82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYR8r3:q2L7HN7Kl/jLA90QECrYR63
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4804	3500	rundll32.exe	84
PID 3500 wrote to memory of 4804	3500	rundll32.exe	84
PID 3500 wrote to memory of 4804	3500	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\505b53effc6c2c6fde39e1d2de03f977_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\505b53effc6c2c6fde39e1d2de03f977_JaffaCakes118.dll,#1
  2⤵
  PID:4804