10d942c3ac86f4061555e81b5971a943679ff0b3606d75276d6d92b18d3a3af2

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 05:27

Target

162dd5fedc022f4b312101de5663f411_JaffaCakes118.dll
Size

1.0MB
MD5

162dd5fedc022f4b312101de5663f411
SHA1

041ab5c400b21de3b95d9e6d2f0d30e88a12c74e
SHA256

10d942c3ac86f4061555e81b5971a943679ff0b3606d75276d6d92b18d3a3af2
SHA512

55af24a97062687a5678896d2446d6c313703728140dbcbaf860a028d6987628b300601b989f8243a6f367b08b75a441a98a5d4e37ab84e3a64f8c7181a0ee8f
SSDEEP

24576:K45U2MJPlSBJsPoT21bm1eKbk5/JnNIIJ7uOXCA1hIS/:zqPlSBkqpbkJJn6WaOXFX/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1588 wrote to memory of 3344	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 3344	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 3344	1588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\162dd5fedc022f4b312101de5663f411_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\162dd5fedc022f4b312101de5663f411_JaffaCakes118.dll,#1
2⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3684