bdce7a58d57dd3db2aabefbe5416f36b6b9912d4c4c64759ea35af086ff157e6

Analysis

max time kernel
137s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 15:37

Target

b44409f4c122ada7dde26034f29f1983_JaffaCakes118.dll
Size

383KB
MD5

b44409f4c122ada7dde26034f29f1983
SHA1

829d89620fdab4ce41bf7a357d1a083481f93dc0
SHA256

bdce7a58d57dd3db2aabefbe5416f36b6b9912d4c4c64759ea35af086ff157e6
SHA512

d93d290bb76199f7f8623cd611d9af643d9edeef73b74607c825d3b349de7e3bc367d22c724d5ae09b6ac8c5705fbec76ff8248282e7c74922b5ff926bbf2434
SSDEEP

6144:6BvGvMM7Oi7cuFQF6/MyT6QEzU56NgLgohbVyGTmMSZvAXDdU:6BvGvMGOGJCsT6QgaLBivAdU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 4532	2184	rundll32.exe	89
PID 2184 wrote to memory of 4532	2184	rundll32.exe	89
PID 2184 wrote to memory of 4532	2184	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b44409f4c122ada7dde26034f29f1983_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b44409f4c122ada7dde26034f29f1983_JaffaCakes118.dll,#1
  2⤵
  PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2708,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:4512