52945fd4c2fb031d291d03fe3d2d0acf1b9ba06c89480814e61214c07450a9ae

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 09:06

Target

395429118cd156976ecb4734a743c120_JaffaCakes118.dll
Size

8.8MB
MD5

395429118cd156976ecb4734a743c120
SHA1

7ffe704d9ec309a73bc7762b7e1808d188b0afd8
SHA256

52945fd4c2fb031d291d03fe3d2d0acf1b9ba06c89480814e61214c07450a9ae
SHA512

47c3e9e93ea89eb99996c21f6a8f8b6fc3f0cc9c53d4809a08eaf414086d98087fd68c25f23662721b5f1e169853d799614235144daf4cc479d51807c758c1d3
SSDEEP

98304:piZq7Y1VW+uJTCR7qPXf7BzzCV4qpyK0xv3ji/kb28EOV9MQ4SErYqURT7+2sMNn:pisCR7qPP71Cfpsd3KkbFFZ9ErmRN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4744	5064	rundll32.exe	91
PID 5064 wrote to memory of 4744	5064	rundll32.exe	91
PID 5064 wrote to memory of 4744	5064	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\395429118cd156976ecb4734a743c120_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\395429118cd156976ecb4734a743c120_JaffaCakes118.dll,#1
  2⤵
  PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:628