c67b37fc12e330873ecb273fe8bafdb4c3a1865de9d9fdeab0e70c66784aa496

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 16:44

Target

a161a7de73508d1fb0466842a936053e_JaffaCakes118.dll
Size

33KB
MD5

a161a7de73508d1fb0466842a936053e
SHA1

74dca75f045979d794dac842f0c0ec23e8ac1262
SHA256

c67b37fc12e330873ecb273fe8bafdb4c3a1865de9d9fdeab0e70c66784aa496
SHA512

bb5fbbbec49711046725a7b5041a161027f8fc20fbdc6797e414ab1c91ad5cd8de83325d25d041d413eb0d176a4490a31c7ce1605a8c305e40aeabce32994995
SSDEEP

768:sLUEHJF2TjGgS2MMkfrlIhTXhbHwSn1+cJgVmP97DI:bEHJ82+MMkcXhblscy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2384	1944	rundll32.exe	92
PID 1944 wrote to memory of 2384	1944	rundll32.exe	92
PID 1944 wrote to memory of 2384	1944	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a161a7de73508d1fb0466842a936053e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a161a7de73508d1fb0466842a936053e_JaffaCakes118.dll,#1
  2⤵
  PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3664 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1860

memory/2384-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download