163aa1cb27ecff1dbeeeb6b6ef86ad171e618605b67c38c8c049a7171ded9957

Analysis

max time kernel
138s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 10:09

Target

0508ce8e5a6123e35706e517de4fb2b2_JaffaCakes118.dll
Size

240KB
MD5

0508ce8e5a6123e35706e517de4fb2b2
SHA1

53fe0e1764afcce005da1af4466b704dbe09e356
SHA256

163aa1cb27ecff1dbeeeb6b6ef86ad171e618605b67c38c8c049a7171ded9957
SHA512

4000d63a7b7dc0ef0980f008f102c48e855386bc168ce118aa1fa91b53b50720255658913e7348115680df25762c39fee3643589b82634ebc9d0c902442ba59d
SSDEEP

384:XPlb6qDoZBArAgKkgfg77euo1jNFYfJq+jp/WsAEBTn8uBBQARQkXkLkNK9COVB6:/lb6qe+rcgqNaTn7BBQARQkXcCOVB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 5000	2416	rundll32.exe	90
PID 2416 wrote to memory of 5000	2416	rundll32.exe	90
PID 2416 wrote to memory of 5000	2416	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0508ce8e5a6123e35706e517de4fb2b2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0508ce8e5a6123e35706e517de4fb2b2_JaffaCakes118.dll,#1
  2⤵
  PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3104,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
1⤵
PID:5056