8c1ced561cabed1d905410a9679918ca2088d76c38dcaeb332ab7fde69c625cc

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 22:14

Target

00d26035b2a88f27106ef6b9b8e06e71_JaffaCakes118.dll
Size

80KB
MD5

00d26035b2a88f27106ef6b9b8e06e71
SHA1

29837deedf4134ec1e66dfaeb1d6bec59ca94d06
SHA256

8c1ced561cabed1d905410a9679918ca2088d76c38dcaeb332ab7fde69c625cc
SHA512

9417927b74a4c602fed16626280b6ab156a8f7d6b08603f0bde38c079509dc1a779e53ee1a07fbd77fee9773c2185c044d27aae98877be525b2b3ed28624e929
SSDEEP

1536:iF0rmQiDkUVWCcZ0HdIosj3Dhq0qe5O8TAwadIoD6p:c0iQiDkqyZ0ufDE0qeciJad5DG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4836	1800	rundll32.exe	90
PID 1800 wrote to memory of 4836	1800	rundll32.exe	90
PID 1800 wrote to memory of 4836	1800	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00d26035b2a88f27106ef6b9b8e06e71_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00d26035b2a88f27106ef6b9b8e06e71_JaffaCakes118.dll,#1
  2⤵
  PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4876

memory/4836-6-0x00000000006C0000-0x00000000006CD000-memory.dmp

Filesize
52KB

Download
memory/4836-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/4836-2-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/4836-0-0x00000000006C0000-0x00000000006CD000-memory.dmp

Filesize
52KB

Download
memory/4836-7-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download