56623c693793157b1f3afd75220281018e09d7f136a62d637993b1bebe628c72

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 10:47

Target

1262b822b67ccb5ff03e0545a424ba2a_JaffaCakes118.dll
Size

1.0MB
MD5

1262b822b67ccb5ff03e0545a424ba2a
SHA1

fb60c00391a4c85e5a756e8f91b76fae9f643204
SHA256

56623c693793157b1f3afd75220281018e09d7f136a62d637993b1bebe628c72
SHA512

9bc9577205e673bbd99d31fe67ba9cca824c48cc6dbf57bbee75035915677bb0c70ec97b69a151022b41109d6392c5879ee2b99d03c3c2bb4909f67b7592b56c
SSDEEP

24576:ptIAeL3+dS6Se7G8+/R8LluaKVw1B4EBGZKiGTpF+9t4+RndA44dI0ZlGOq:z2WS6J30a+RdCddC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4000 wrote to memory of 1236	4000	rundll32.exe	rundll32.exe
PID 4000 wrote to memory of 1236	4000	rundll32.exe	rundll32.exe
PID 4000 wrote to memory of 1236	4000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1262b822b67ccb5ff03e0545a424ba2a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1262b822b67ccb5ff03e0545a424ba2a_JaffaCakes118.dll,#1
2⤵
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1332