9d073c33072435e03e4b370d27c61b06ac3bc71eee5741244bc689dbb13ede44

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 12:39

Target

f1132ef5914e6c51c4076fcaffed90a0_JaffaCakes118.dll
Size

6KB
MD5

f1132ef5914e6c51c4076fcaffed90a0
SHA1

5eb115983caf142b0739da21c6e67f05a9c371b3
SHA256

9d073c33072435e03e4b370d27c61b06ac3bc71eee5741244bc689dbb13ede44
SHA512

b172f50871575b673829f936004f6007fab94a8f8abc3b910a4ae399809e1be7727d0d5ec7f4b3dc79b011d1747f582d32b0abe68cfef128a84335a0061843b2
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0HB+BDq9J5SC:8qtV0HAr4uB+FqX5SC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2512	4400	rundll32.exe	91
PID 4400 wrote to memory of 2512	4400	rundll32.exe	91
PID 4400 wrote to memory of 2512	4400	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1132ef5914e6c51c4076fcaffed90a0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1132ef5914e6c51c4076fcaffed90a0_JaffaCakes118.dll,#1
  2⤵
  PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3208 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:2324