9d66a23b87e930269204272a71063d5e616a7b40cd6e9e08775c26c23a135a2b

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 17:23

Target

604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118.dll
Size

254KB
MD5

604bbf50778c5ddc4a8ff974d12c9296
SHA1

e8043e4a32fc3a3da97db2c98a004880f574030b
SHA256

9d66a23b87e930269204272a71063d5e616a7b40cd6e9e08775c26c23a135a2b
SHA512

f71d456020063b1dbf8e06bad519f287ec9aa569c2aa2a2318615994fe346b3edbce8117e72b473fbb4c7f010814dd03902cedce7aabf3ff447d980747e22a62
SSDEEP

3072:2SfGIqV98OeZybMPgHN5rHy0mmaK2lJ1xJuY+2vOTW0L8zNO3I52Qm:2SHqV98QbIvnlJ1NKW0LYsom

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 1712	3932	rundll32.exe	91
PID 3932 wrote to memory of 1712	3932	rundll32.exe	91
PID 3932 wrote to memory of 1712	3932	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\604bbf50778c5ddc4a8ff974d12c9296_JaffaCakes118.dll,#1
  2⤵
  PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:4996