4a3e3deab71388cc5a8814298c6c308dc83e8b702233cbacb57b4d14a7900f2e

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:59

Target

689dae1c7ed0f54800f3cd6341521bd4_JaffaCakes118.dll
Size

1.3MB
MD5

689dae1c7ed0f54800f3cd6341521bd4
SHA1

fa02086912e5ed626c16dcd2cc47ee49b21428fd
SHA256

4a3e3deab71388cc5a8814298c6c308dc83e8b702233cbacb57b4d14a7900f2e
SHA512

4e4074d273a35a54b3b0e6631b5df5ac68e273fa224d4b062cb24d7bd82471b19a86d9d01e2856ce73b4cec8169d0185df77cdfb09c7044d45e5f1bf7ffe8205
SSDEEP

24576:I5BaLMhzx0KOitdx3iUc9oAXNxtXEFn8NEoJ2DqBDoQmgjztDbEdu6+HBm2:a0wdx3kN3ZCDqBJmC96+HBd

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4112 rundll32.exe
4112 rundll32.exe

pid	process
4112	rundll32.exe
4112	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3304 wrote to memory of 4112	3304	rundll32.exe	rundll32.exe
PID 3304 wrote to memory of 4112	3304	rundll32.exe	rundll32.exe
PID 3304 wrote to memory of 4112	3304	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\689dae1c7ed0f54800f3cd6341521bd4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\689dae1c7ed0f54800f3cd6341521bd4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3788 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3608