58f42f7e3005b33be5ccb8ccb4cd029a3823c2e22de4bc936ceb20fd19de1ec6 | Triage

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0584e75c78d1c592c4f0a656f7c86417_JaffaCakes118.dll
Size

3KB
MD5

0584e75c78d1c592c4f0a656f7c86417
SHA1

830407b95490b3da0515cae28aa7209b3c04e687
SHA256

58f42f7e3005b33be5ccb8ccb4cd029a3823c2e22de4bc936ceb20fd19de1ec6
SHA512

2ef8643eee58f689f2e849871aa3baaeb01ebd8966ee662f6179367ebc456d263a05e2770be6519d62a171f5f9f4acf492eea0cdbc3aabf2dc674beba7628462

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3392	4680	rundll32.exe	90
PID 4680 wrote to memory of 3392	4680	rundll32.exe	90
PID 4680 wrote to memory of 3392	4680	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0584e75c78d1c592c4f0a656f7c86417_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0584e75c78d1c592c4f0a656f7c86417_JaffaCakes118.dll,#1
  2⤵
  PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1416,i,15316930299780304231,7592852768794498680,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:8
1⤵
PID:5000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads