74aeea6387a4fd60be2a0a12c1a61c4bdeefdc519e20328ac07e80beee3234a1

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 04:21

Target

b1b3258064f7e4fa135211210e5fffd5_JaffaCakes118.dll
Size

12KB
MD5

b1b3258064f7e4fa135211210e5fffd5
SHA1

81f80ff835907eb12ee9f53e75b91289b69e8279
SHA256

74aeea6387a4fd60be2a0a12c1a61c4bdeefdc519e20328ac07e80beee3234a1
SHA512

9331b1ccfe4696e5ae671ec9414e096311a6e1442a3f34eb97bbb36b8b363475c270fdd779eff944d81743b2d8fe71f1348303e2ce93a0bbeed3c3e8cf7826c9
SSDEEP

192:8PpZMlbVJyLcKUr8eQCljjJ597EzplpNBeNKxmp2gfyPj3sBCUYp:IPMlDyvABJ61lLBLxephcUYp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 536	3232	rundll32.exe	90
PID 3232 wrote to memory of 536	3232	rundll32.exe	90
PID 3232 wrote to memory of 536	3232	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1b3258064f7e4fa135211210e5fffd5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1b3258064f7e4fa135211210e5fffd5_JaffaCakes118.dll,#1
  2⤵
  PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4080,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
1⤵
PID:4124

memory/536-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download