71297955ad65a075b8f7468c3bccb080ff60e8790a07edc5173cb28ce93f6486

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 22:20

Target

8518a535cb26e310321a2ddb6cea8980_JaffaCakes118.dll
Size

63KB
MD5

8518a535cb26e310321a2ddb6cea8980
SHA1

51b35c9fd80e669b7ebdeb1e29f18cabe7cd0d23
SHA256

71297955ad65a075b8f7468c3bccb080ff60e8790a07edc5173cb28ce93f6486
SHA512

63e1b403f82bac99cd3179f0c2235c1afe72397a2aaa33a87bc516c0050ae962e5f6d46259d68d57ac54a47c1123014ee1b6a28fee202cba7d39cd2bb43ecbe4
SSDEEP

1536:YFT2IyJsYzookcRiJW88z0h2ZG6y50MTfdtpfpu:YFvokJJNhH6y5jB/s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3248	3508	rundll32.exe	90
PID 3508 wrote to memory of 3248	3508	rundll32.exe	90
PID 3508 wrote to memory of 3248	3508	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8518a535cb26e310321a2ddb6cea8980_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8518a535cb26e310321a2ddb6cea8980_JaffaCakes118.dll,#1
  2⤵
  PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4512