d60aa06685ad903e45e895991d24ff88423fb69a10e2641561e6abc575be5626

Analysis

max time kernel
136s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 20:29

Target

f443f7562770d445d711c434918c51d3_JaffaCakes118.dll
Size

353KB
MD5

f443f7562770d445d711c434918c51d3
SHA1

4f69061464f94626ddf98d6a1a67b3129834d909
SHA256

d60aa06685ad903e45e895991d24ff88423fb69a10e2641561e6abc575be5626
SHA512

d1dfdefa764db6942495aec8d8cd6ec1964ac51daa91f3277a5d506b3b3d78d0e927628bdc5acbcafe3d5afdd9d0a3a43977b4680a6d9ee87c02276dd833d2f9
SSDEEP

6144:qQcHW75VIZF3W0/zQSypEoaO7b/vUk883c8X8BQjfwmZzeQ2:z75C5kh/vm8X8SjxeQ2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 3728	1504	rundll32.exe	92
PID 1504 wrote to memory of 3728	1504	rundll32.exe	92
PID 1504 wrote to memory of 3728	1504	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f443f7562770d445d711c434918c51d3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f443f7562770d445d711c434918c51d3_JaffaCakes118.dll,#1
  2⤵
  PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4604

memory/3728-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download