d3fbbed563ee74158a5cd5a4320889338738d24aef5443916d184f1286547ae7

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 18:44

Target

bfe951c9a05481aae1290e549aaaa7f3_JaffaCakes118.dll
Size

931KB
MD5

bfe951c9a05481aae1290e549aaaa7f3
SHA1

a8cc5f5a1c3d4e34f4966affca2472f7abc474ed
SHA256

d3fbbed563ee74158a5cd5a4320889338738d24aef5443916d184f1286547ae7
SHA512

9671400b5d8f234eced22593d0082e4a9b34970a045f5dc9965caab43f654293559f01a8dc71fa0d0fbb749ecbbf99a612263a1a77fa394b248bcbd5acd4b6d0
SSDEEP

24576:tRRVhAfrCFewJSBvuVSxGsGcp3eEXXraxJDrFGLwBP:TewpSR3/XXrwnXP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3156	2128	rundll32.exe	94
PID 2128 wrote to memory of 3156	2128	rundll32.exe	94
PID 2128 wrote to memory of 3156	2128	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfe951c9a05481aae1290e549aaaa7f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfe951c9a05481aae1290e549aaaa7f3_JaffaCakes118.dll,#1
  2⤵
  PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4596