c63d21e659c738bf6f39b8608045c69f6a516e40155be20d2c5c3e766e6f90f8

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 12:10

Target

219c963c3c2800f3955876bbc202a6a7_JaffaCakes118.dll
Size

37KB
MD5

219c963c3c2800f3955876bbc202a6a7
SHA1

35dcca1efcb1386c7608130b9051210e1e4dc875
SHA256

c63d21e659c738bf6f39b8608045c69f6a516e40155be20d2c5c3e766e6f90f8
SHA512

9781a138a19987ba5f63f29dc6718182278bf0ec9a664d6dcbe2d4134ad5a63957879917bf840807dd3541779ca2cae641dc064f0e2677b57f72dfa6ae456482
SSDEEP

768:4ETEXWL6Q3t9HeLKMHn9X9nCJ8webKEkbcZj:4g6Et9HeWOn9tnCGwNEkbcZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1848	2028	rundll32.exe	93
PID 2028 wrote to memory of 1848	2028	rundll32.exe	93
PID 2028 wrote to memory of 1848	2028	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\219c963c3c2800f3955876bbc202a6a7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\219c963c3c2800f3955876bbc202a6a7_JaffaCakes118.dll,#1
  2⤵
  PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2676