d66141bdfe66974c3f46f043af8003958a4b075c0d1058072826bf71ed6a9772

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 03:02

Target

f95c12ffe59d184431daec724be28894_JaffaCakes118.dll
Size

758KB
MD5

f95c12ffe59d184431daec724be28894
SHA1

bb526bb357e1b5b8489583a074360548d4261fff
SHA256

d66141bdfe66974c3f46f043af8003958a4b075c0d1058072826bf71ed6a9772
SHA512

2bec0159b7535ab12fdd2324c5f5cb134938dc4ad32772b22855a9a9dacb1bd355ce673a87969ddbde0fd318e6b504f40060ffc5361c9ef43f8f693f088ed4f4
SSDEEP

192:QPMT/KSXU430GRbjcdHEZNltr9ieoPQiu6rU5fz5deF04VCbcTAjttYAyF8pMy6B:n/KSXS+w6Lok64TAu/vKfy6K0o4d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 3488	3252	rundll32.exe	91
PID 3252 wrote to memory of 3488	3252	rundll32.exe	91
PID 3252 wrote to memory of 3488	3252	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f95c12ffe59d184431daec724be28894_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f95c12ffe59d184431daec724be28894_JaffaCakes118.dll,#1
  2⤵
  PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:2976

memory/3488-0-0x0000000020000000-0x000000002006C000-memory.dmp

Filesize
432KB

Download