75272ca1c978d17044632ff35c104311219d4076a8ee37c4e9a2fff5f298a4fa

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 17:32

Target

eb9e0f3739941a967efc85e3eb556e6a_JaffaCakes118.dll
Size

33KB
MD5

eb9e0f3739941a967efc85e3eb556e6a
SHA1

8658b0e40285bbdb21ec71261af856548e25d960
SHA256

75272ca1c978d17044632ff35c104311219d4076a8ee37c4e9a2fff5f298a4fa
SHA512

9a276c6c8405db741d19471df05583db4f3f55e4a9ffb5e2b2538d2923cacf518e62c9ea57e89f6fa3254e0a90bc05b1fc4da6368382df69b7c6bdb091b86a3f
SSDEEP

768:U8pjghrK5eEOyzNqi9UHjA7Vsc7vHFT35hcDCsjpRZd/aI:U8pjarK5eNH8X7vlTpCusjpRz/5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb9e0f3739941a967efc85e3eb556e6a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb9e0f3739941a967efc85e3eb556e6a_JaffaCakes118.dll,#1
  2⤵
  PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:3300