bf2026f6fdcaa0b96ea50af13a39b357e529c8c21dcc747e1db0b25822aac9b1

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 02:06

Target

fe2e1c0c64647bfe5958b47dc4acbdc8_JaffaCakes118.dll
Size

52KB
MD5

fe2e1c0c64647bfe5958b47dc4acbdc8
SHA1

28b51623fe74cb33846deb2e817af957cbe8d4c4
SHA256

bf2026f6fdcaa0b96ea50af13a39b357e529c8c21dcc747e1db0b25822aac9b1
SHA512

eb739a616e33ba8c2f03d9903172859c86971511874c673e32e7994cc6b4e151119e55e59d5136d85ccdde0bd44383b1467e7b41cae0f857d968e4c6286551d1
SSDEEP

1536:0aRQ1YL9E2Da7NZ5Zdpj+Jjx1FEthd0IhwDmRj:zR/FD8ZPr+52d0Ij

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2260	4284	rundll32.exe	90
PID 4284 wrote to memory of 2260	4284	rundll32.exe	90
PID 4284 wrote to memory of 2260	4284	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe2e1c0c64647bfe5958b47dc4acbdc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe2e1c0c64647bfe5958b47dc4acbdc8_JaffaCakes118.dll,#1
  2⤵
  PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:1052