2d5d518a3008bbd93cb154da49db6bade0603f3fccca48b060e23ed773538225

Analysis

max time kernel
144s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 09:14

Target
5b4f62f19ee16339d44833a95bd1cc3f_JaffaCakes118.dll
Size 330KB
Sample240719-k7eldaxaka
SHA256 2d5d518a3008bbd93cb154da49db6bade0603f3fccca48b060e23ed773538225
MD5 5b4f62f19ee16339d44833a95bd1cc3f
SHA1 8f828d1e938987147bbaec01ee994c06b5f83be8
SHA512 ebfb84bba8058112ff22971642e82a66531f264496540d9b93e92d076bc605027ac36ad0d3eec0a763078d68dd33e06dfc4a755a7cd217db8f111faa4714f605
SSDEEP 3072:4Rq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:Cq1sFAwgwmBv3wnIgG4oAYxvU54eu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4168	2796	rundll32.exe	84
PID 2796 wrote to memory of 4168	2796	rundll32.exe	84
PID 2796 wrote to memory of 4168	2796	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b4f62f19ee16339d44833a95bd1cc3f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b4f62f19ee16339d44833a95bd1cc3f_JaffaCakes118.dll,#1
  2⤵
  PID:4168