e1ff46ec09545646d92f0b1734c7facb7429802fd476d2806dd54faccfbf4a87

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 18:15

Target

ebb1991db313bddeeb0128e6ee71e069_JaffaCakes118.dll
Size

91KB
MD5

ebb1991db313bddeeb0128e6ee71e069
SHA1

543fc364724738573abaf298139164b339521a08
SHA256

e1ff46ec09545646d92f0b1734c7facb7429802fd476d2806dd54faccfbf4a87
SHA512

07c208b99d4ce5264e4a00d7cd7c3e6b22fdb62f9ad46f76b2ae3e2f752eefa4fece57124c62550f50d8ea8aede0a84037c4a34203d12bff34c1349f2d0df973
SSDEEP

1536:XKq3hQ3BVwGfOcnJf2xqKG4IntFSr/gAi9++3Oni3b:6AkbwFWJfaxTITAj+3Oni3b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4048	3052	rundll32.exe	93
PID 3052 wrote to memory of 4048	3052	rundll32.exe	93
PID 3052 wrote to memory of 4048	3052	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebb1991db313bddeeb0128e6ee71e069_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebb1991db313bddeeb0128e6ee71e069_JaffaCakes118.dll,#1
  2⤵
  PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2132,i,4018525042804461719,1997165676266557055,262144 --variations-seed-version /prefetch:8
1⤵
PID:3324

memory/4048-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download