e7af0f1b3e52cd1e457c1c2cf1dbf52e19fa5ad61f84519d5c3234ffd129312d

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 16:24

Target

ffb1dc466f9c4f5c2b04176fe2da8b20_JaffaCakes118.dll
Size

77KB
MD5

ffb1dc466f9c4f5c2b04176fe2da8b20
SHA1

c4051f37609699667e58e88f58925d07f151d5d3
SHA256

e7af0f1b3e52cd1e457c1c2cf1dbf52e19fa5ad61f84519d5c3234ffd129312d
SHA512

773984718ac6265e96152e609735dfada382632c88c88156de39f9fb0f75af861147c55e83ac3c488489a06bdd203be9e5775f8bc04f9b663a90b26e7ca60a84
SSDEEP

1536:BS4ssNgkR8ecfV0gQUMT/d00Zgk3D0Vtcoqsc7q:BPLr8nPQdFvDMtcoqscu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 4748	824	rundll32.exe	90
PID 824 wrote to memory of 4748	824	rundll32.exe	90
PID 824 wrote to memory of 4748	824	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb1dc466f9c4f5c2b04176fe2da8b20_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb1dc466f9c4f5c2b04176fe2da8b20_JaffaCakes118.dll,#1
  2⤵
  PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4620