02f128881f7c2875605f8ca16e60ea338a4a4338ad49b6e64c2e555cea7ea4db

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 05:35

Target

e956b19e5d9deab0524252497a20f742_JaffaCakes118.dll
Size

64KB
MD5

e956b19e5d9deab0524252497a20f742
SHA1

f4ec96ddb7c0a4fe8297eb9b15df2da814268965
SHA256

02f128881f7c2875605f8ca16e60ea338a4a4338ad49b6e64c2e555cea7ea4db
SHA512

c1381dbd51ef25c587a91a2b4941c1e9e217c8c97f79a6fdf363ea15a3abab51240043fdff1754887d2e653f1f15c8dc3b88786138d453a7b76e354211318dcd
SSDEEP

768:7HLEjXqOcy48wA+LkoqW8lyTxkw9U2p26wbzC5sdxMjiB9UQgwWHiGOs3qU:7WaC+Ltq1lyTCM8nzN4los6U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4408	904	rundll32.exe	93
PID 904 wrote to memory of 4408	904	rundll32.exe	93
PID 904 wrote to memory of 4408	904	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e956b19e5d9deab0524252497a20f742_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e956b19e5d9deab0524252497a20f742_JaffaCakes118.dll,#1
  2⤵
  PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1376