23c9e35a5687c1f6bdb060a903c2925ca32ecc2ebcd8150b39c158c149403fc0

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 09:13

Target

04db3f62702b69bbe5630d775d29da03_JaffaCakes118.dll
Size

1.0MB
MD5

04db3f62702b69bbe5630d775d29da03
SHA1

42a926c9f735357d50abb87cc06da8c500626a34
SHA256

23c9e35a5687c1f6bdb060a903c2925ca32ecc2ebcd8150b39c158c149403fc0
SHA512

3bce6519315c8090d2ba0e42375c164f892c35005c95c1eddf94b659367059b73fcf1d2c3288d223a980b0e806947cd32e6b03d834743200da2b8afe68fd7543
SSDEEP

12288:pJo3YJaznF6tiF/NvI0q0lPl3YhGFrAtpxE5xfaVv9E+kXjFLT5QOgP/w3X46BZN:p8UinF6EU+Puh0c3wH4639ud2umh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2548 wrote to memory of 1188	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 1188	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 1188	2548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04db3f62702b69bbe5630d775d29da03_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04db3f62702b69bbe5630d775d29da03_JaffaCakes118.dll,#1
2⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3764 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4664