33ea65b2f2fa5d58b0f326b70f681e912a19176752b264fe2f416f90ea861708

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 09:54

Target

e9ba2907922a185afd31216064c9116c_JaffaCakes118.dll
Size

65KB
MD5

e9ba2907922a185afd31216064c9116c
SHA1

79e7a02430fe1a66263f3e853bcecc91e5b02083
SHA256

33ea65b2f2fa5d58b0f326b70f681e912a19176752b264fe2f416f90ea861708
SHA512

c6c3b90b6c69d96e8b2d330cf67440a9a75a18639da6c3cd200b26c71d8ea2ed5a5ff4c35346db5ff9f6387a5570748d8b2bcd7760f4e6bea3ddd17f7d1c0643
SSDEEP

768:q/C3oU4k4tyAxTZshTcLCMcm3WnR+MQdlFwgrgGHycb/36dM+8q65Oev/0:t334gAxTCTckm3WnRqbFDNHlSdloOI/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2920	4712	rundll32.exe	92
PID 4712 wrote to memory of 2920	4712	rundll32.exe	92
PID 4712 wrote to memory of 2920	4712	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9ba2907922a185afd31216064c9116c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9ba2907922a185afd31216064c9116c_JaffaCakes118.dll,#1
  2⤵
  PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4436

memory/2920-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download