a3f276336cae0a666ed1bf8409699277b92e3acddf133a1b1e5232e4b3d48d68

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 08:04

Target

04391e6bf809e2030ab29f31d0d242a3_JaffaCakes118.dll
Size

1.4MB
MD5

04391e6bf809e2030ab29f31d0d242a3
SHA1

a6582fee18f62ff5da7f3e8e0f50b8d8c65eda56
SHA256

a3f276336cae0a666ed1bf8409699277b92e3acddf133a1b1e5232e4b3d48d68
SHA512

18d040fc6eb681a072bbf60428ef86183b03834e09f411a54b39c04afaa34e6a4b7bd001436eddec6778a92047375c716ee74bd7daf3473cdefbe945410718b9
SSDEEP

12288:yXQn62pe58JOm76wt/364zF727pWNdFTEoFQL/SJ8p:yXa6IM8gwt/364hC7kdTBM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2756	1168	rundll32.exe	89
PID 1168 wrote to memory of 2756	1168	rundll32.exe	89
PID 1168 wrote to memory of 2756	1168	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04391e6bf809e2030ab29f31d0d242a3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04391e6bf809e2030ab29f31d0d242a3_JaffaCakes118.dll,#1
  2⤵
  PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3988,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
1⤵
PID:2716