7de6610cb3b6acd993915ca9734770d539a8fb28b97d38f3b9101e1067ad0564

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 23:05

Target

f8f33fbb23a67b1140c918063c947f52_JaffaCakes118.dll
Size

123KB
MD5

f8f33fbb23a67b1140c918063c947f52
SHA1

92ecea6803089764bf21375e9fdbd0f480f29470
SHA256

7de6610cb3b6acd993915ca9734770d539a8fb28b97d38f3b9101e1067ad0564
SHA512

8b462eaf50673b7bb7c0f7487ceb644e43a833a9d05397bcad3320e8e160fb99909678d0afdcf5be6311d9a45f0f6bcda730c059d11093f750044254b57a4f26
SSDEEP

3072:rSznVa22olGyU26MKJtSfD2FFQ4uUDC4kq63C1cFYYV0B9lc9:CabolGyU1KD8l6y1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 968	4752	rundll32.exe	90
PID 4752 wrote to memory of 968	4752	rundll32.exe	90
PID 4752 wrote to memory of 968	4752	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f33fbb23a67b1140c918063c947f52_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f33fbb23a67b1140c918063c947f52_JaffaCakes118.dll,#1
  2⤵
  PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:1388

memory/968-0-0x00000000003B0000-0x00000000003D3000-memory.dmp

Filesize
140KB

Download