211eb648e7e0427eb96c171c1abfcf775d42a7e812cace9528536a3c43bc9341

Analysis

max time kernel
141s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 11:45

Target

24b3cb0fc98aa232077fd496d19aa750_JaffaCakes118.dll
Size

79KB
MD5

24b3cb0fc98aa232077fd496d19aa750
SHA1

048e7f2b8f27bcc509bd8849034d7b69aa11dfb3
SHA256

211eb648e7e0427eb96c171c1abfcf775d42a7e812cace9528536a3c43bc9341
SHA512

6cd325bb15223c50d309019b55ba469ef3818b193ca3bdfff0d5a1f003e9d09d0704a093f2b6ab9fb048703f3cf7e7be3be08e47d934763593135ad2a2dbadba
SSDEEP

768:/8jy694/7LsWkFMalLepofSEtkU5yXNkOhPpEniteDH/J6/Wfed76n2YEDZ4w47Q:0WuKk3lIo8kCanqeV1fwCck

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1756	4412	rundll32.exe	91
PID 4412 wrote to memory of 1756	4412	rundll32.exe	91
PID 4412 wrote to memory of 1756	4412	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24b3cb0fc98aa232077fd496d19aa750_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24b3cb0fc98aa232077fd496d19aa750_JaffaCakes118.dll,#1
  2⤵
  PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3964 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3696