e7d58bf051b2020e2ffab143e64867c1c752f2f53e41b7213187291396a68ff4

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 06:02

Target

164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll
Size

1.0MB
MD5

164d3eb9295c58aa47f7184482e837c6
SHA1

8dd418f665e6d0b3d9ad06dc5c0a0291283c9d7d
SHA256

e7d58bf051b2020e2ffab143e64867c1c752f2f53e41b7213187291396a68ff4
SHA512

e480adf4796fe72f4fef227cf450c552189ddfa52a14ea92c0009362b1824845d8d70c9c0683177022d47d920246549e48adea043e5a9c79a76faefac8282de1
SSDEEP

24576:RgDKNwzqg57SKQeNbhq0HgKsOwYGLD0MCg:67qg57Jjq05sO+W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4656 wrote to memory of 2772	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 2772	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 2772	4656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll,#1
2⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2484