ffc3fa6b0a062d7ade0f5c019bd6489b64dcf8eeaf2ad766cd724ad5030f15d9

Analysis

max time kernel
139s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 05:58

Target

036e7187f84affa70dc609393119c616_JaffaCakes118.dll
Size

25KB
MD5

036e7187f84affa70dc609393119c616
SHA1

8a544f0aa25f720300dbc65ae047114e9b291426
SHA256

ffc3fa6b0a062d7ade0f5c019bd6489b64dcf8eeaf2ad766cd724ad5030f15d9
SHA512

1aa9edd8b84d8571b0cbfea32bfe018360ed35088f846816c272558e573632f7573ccd665315a059a930569c303203b7527c43b5e7579e6b846b151a9d1e4d06
SSDEEP

384:W+X9N4N+ApWm3yprKYaRbD3KR77DIzRh9FNaYN728EaRZnkH:W+LAw8y4YaRqR74zRhj0YN7fRdkH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2180	3288	rundll32.exe	90
PID 3288 wrote to memory of 2180	3288	rundll32.exe	90
PID 3288 wrote to memory of 2180	3288	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\036e7187f84affa70dc609393119c616_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\036e7187f84affa70dc609393119c616_JaffaCakes118.dll,#1
  2⤵
  PID:2180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4168,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
1⤵
PID:1928