e6b66bbe2b4cabab6a22c315069121ec7affd761bedb931a8c4bc8ef07f6415d

Analysis

max time kernel
115s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 10:50

Target

e9d21bcf810f135ce407ddedfd3c5da3_JaffaCakes118.dll
Size

48KB
MD5

e9d21bcf810f135ce407ddedfd3c5da3
SHA1

86004bd038db96318ac7363e9511b4b1acb2e8be
SHA256

e6b66bbe2b4cabab6a22c315069121ec7affd761bedb931a8c4bc8ef07f6415d
SHA512

9c3f85620cc6780c5e519453d0de22eda974f12b888e6b26ef73c925658750476cb4ca98613b0e67359108062dd100e5a25222caaca4b6a3bac25aca35d6ed3d
SSDEEP

768:FQkPTrZzZYqNoZiznXwZ2n6r6NhfNpYdDKuaoXlvGbFaASd69Eo6g1msrjP/DC30:ZrrbZN7znXYCzp+lOB9D+8ZPW3kN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2476	1568	rundll32.exe	90
PID 1568 wrote to memory of 2476	1568	rundll32.exe	90
PID 1568 wrote to memory of 2476	1568	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9d21bcf810f135ce407ddedfd3c5da3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9d21bcf810f135ce407ddedfd3c5da3_JaffaCakes118.dll,#1
  2⤵
  PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3660 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:2808

memory/2476-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2476-1-0x0000000001190000-0x0000000001199000-memory.dmp

Filesize
36KB

Download
memory/2476-5-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download