11a4dced7acbf55832ebdad2e2a057c3fdc8ae506bb4586ae6d0c3c5377e6b3c

Analysis

max time kernel
131s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 18:48

Target

6841dd0a962d3d3b876df3555539cdc6_JaffaCakes118.dll
Size

840KB
MD5

6841dd0a962d3d3b876df3555539cdc6
SHA1

6425ef627d9ef57773a819c6a290f4b5f70bdd13
SHA256

11a4dced7acbf55832ebdad2e2a057c3fdc8ae506bb4586ae6d0c3c5377e6b3c
SHA512

d2ba564163c22054a73ba1a4735217bdb8a50597bf8d0caf431a0a4a1f1dbb85f05d3a2b869b8cc6faa854b4402fc31323f9f90e032c957279e468988e63d4a5
SSDEEP

12288:kkGrEPShCLre3hKwH+TgZKj+rq4Dzr1YKP1VwDPDN9umG1ljvjgtRsNc4K:kk3uCLi3hKM+0lqozyVDPJgn3dU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2680	4092	rundll32.exe	92
PID 4092 wrote to memory of 2680	4092	rundll32.exe	92
PID 4092 wrote to memory of 2680	4092	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6841dd0a962d3d3b876df3555539cdc6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6841dd0a962d3d3b876df3555539cdc6_JaffaCakes118.dll,#1
  2⤵
  PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3688,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
1⤵
PID:620