40850016bcdcfc8dc47c5ff22d6a1f8fb8c7ecfbbec8972261c421e1b2b336e6

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 11:06

Target
6754a521e208f5c8646c89b97a150595_JaffaCakes118.dll
Size 340KB
Sample240723-m7m9matbml
SHA256 40850016bcdcfc8dc47c5ff22d6a1f8fb8c7ecfbbec8972261c421e1b2b336e6
MD5 6754a521e208f5c8646c89b97a150595
SHA1 59baadd204c91598883f88c792e424e475ca0b4d
SHA512 07f63843675b7a0967f9930fe5a7b51382a753abf177a4169b601162d844705ea0c4e32ed0d0434dd54b7b3d842b0ecf96f4022348c4943aff8f8185b4503648
SSDEEP 3072:CUvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:CU206xWgGxLxWN40PDKR/JnX2P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1612	2852	rundll32.exe	84
PID 2852 wrote to memory of 1612	2852	rundll32.exe	84
PID 2852 wrote to memory of 1612	2852	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6754a521e208f5c8646c89b97a150595_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6754a521e208f5c8646c89b97a150595_JaffaCakes118.dll,#1
  2⤵
  PID:1612