cb9058080e2feaa18ead3401a02d88b00d36fdf66387ccd1b75854d7bbd24311

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 12:18

Target
4e48924782ec7e53df704c8e90dc5aec_JaffaCakes118.dll
Size 340KB
Sample240716-pgr61ascpl
SHA256 cb9058080e2feaa18ead3401a02d88b00d36fdf66387ccd1b75854d7bbd24311
MD5 4e48924782ec7e53df704c8e90dc5aec
SHA1 eb8b41e7a234a278ab72ff577f6ab6fb8fdc301f
SHA512 c063c6dedc4102941781f91e1b17cebc8d480f34539e9eb3ec71b36ef88035a7f5802a1f612854a62760d3d6704d09e911f98a6e44e0b1e2db484154be72505b
SSDEEP 3072:ZvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:Z206xWgGxLxWN40PDKR/JnX2P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4032	4940	rundll32.exe	83
PID 4940 wrote to memory of 4032	4940	rundll32.exe	83
PID 4940 wrote to memory of 4032	4940	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e48924782ec7e53df704c8e90dc5aec_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e48924782ec7e53df704c8e90dc5aec_JaffaCakes118.dll,#1
  2⤵
  PID:4032