2c682a9a55ad19ef4958d4927bac7bd827a70c9c13dc5377ed1192714bfb80c9

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 08:51

Target

66b2b8dc375ea2ebc3419b591ac1940e_JaffaCakes118.dll
Size

156KB
MD5

66b2b8dc375ea2ebc3419b591ac1940e
SHA1

76c18c65463ce12ffa64da8e777a748ac0f6a6ab
SHA256

2c682a9a55ad19ef4958d4927bac7bd827a70c9c13dc5377ed1192714bfb80c9
SHA512

9bc4c78e9c995a14eaadec833f5aa8742d75cc06f7985275cb8bbbf29b2c5cede351869df0a9f749f1457dd57b7506890e2642d1e9a8dcfbbe4b84cfc7c99e16
SSDEEP

3072:ao7+1JG/ca1EJU8yGotXb2l1DXghkPB2zTNE+qgg3W+fds8kflLnprjFtv1DbKGN:ao7+1JG/ca1EJd7otXb2l17gqB2zpE+3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1976	4740	rundll32.exe	90
PID 4740 wrote to memory of 1976	4740	rundll32.exe	90
PID 4740 wrote to memory of 1976	4740	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b2b8dc375ea2ebc3419b591ac1940e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b2b8dc375ea2ebc3419b591ac1940e_JaffaCakes118.dll,#1
  2⤵
  PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4396,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:4888