d616306b4bbe2f0d90f2674463b56aad7a19fc60fdf795474557fa4f0275e31e

Analysis

max time kernel
115s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 04:46

Target

fbf51c7c96f11de65107b212f9de7e17_JaffaCakes118.dll
Size

78KB
MD5

fbf51c7c96f11de65107b212f9de7e17
SHA1

5572d667d1982384636b1e362bcf2637875fb343
SHA256

d616306b4bbe2f0d90f2674463b56aad7a19fc60fdf795474557fa4f0275e31e
SHA512

3ed6b63ff7ece87d2426112d09040ee43ce35cd4486a6698b0a0f7d01e9387528002552544b0dcd0eb690458e9b34845b84b6578b0180f401e62e242f0a31c3e
SSDEEP

1536:booPRANY2D80BmIZcaXiILWYrOdmfoo//Hi7ThMUy1y/fOBhVw52OevA:bo4RADnmIZc0SYmmJ//HETWk/fOOw4

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepion.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
680	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4620	5100	rundll32.exe	90
PID 5100 wrote to memory of 4620	5100	rundll32.exe	90
PID 5100 wrote to memory of 4620	5100	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbf51c7c96f11de65107b212f9de7e17_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbf51c7c96f11de65107b212f9de7e17_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:2368

memory/4620-0-0x0000000025000000-0x0000000025064000-memory.dmp

Filesize
400KB

Download
memory/4620-6-0x0000000025000000-0x0000000025064000-memory.dmp

Filesize
400KB

Download