3cd0aec175db0fb0ab46fe7eca3749c3b82caa478d988dc8fd50b5b37a1fec42

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 18:02

Target

fd50df1d245855d805e281e54db14a0b_JaffaCakes118.dll
Size

97KB
MD5

fd50df1d245855d805e281e54db14a0b
SHA1

f4d5d24e7a0ed715a1475a2227030abb78317c26
SHA256

3cd0aec175db0fb0ab46fe7eca3749c3b82caa478d988dc8fd50b5b37a1fec42
SHA512

46b07b1f21589f66653865717d61447b48d4ef93c30a1244bc068eb6b686c4a6c53e90ec2bd871b23b22e0c2f6023f2117fa2a366431d0c55bd752e2cd4d2f83
SSDEEP

1536:eIb/I0ICkuvfZ/AuwKd6kaTEWFSPtcAJn91fpj/D7+C+Y/105b:eMzhxvfGK1wSPtNn1pj/DiCh10

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 4660	372	rundll32.exe	93
PID 372 wrote to memory of 4660	372	rundll32.exe	93
PID 372 wrote to memory of 4660	372	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd50df1d245855d805e281e54db14a0b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd50df1d245855d805e281e54db14a0b_JaffaCakes118.dll,#1
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:1428

memory/4660-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download