5e8d059e4e1fb45b2db8756a921a2647892d5139bf6baca6f080207b8a36e17a

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 15:23

Target

073cd8f01296d2fb5e8be971e50f78f5_JaffaCakes118.dll
Size

194KB
MD5

073cd8f01296d2fb5e8be971e50f78f5
SHA1

87baf60011afd4328398fb0bab93e2c4226ef34d
SHA256

5e8d059e4e1fb45b2db8756a921a2647892d5139bf6baca6f080207b8a36e17a
SHA512

4e976acccf60dba2c33ab764f34e6ed2378c2dcb887208ae1e0874e3c5d3cdcdd141908ff9bf6e98a520d5a88918d767ffd280ee7beb118e120d4fbba831c744
SSDEEP

3072:DojoC3OgonEVPgZNXIzjMX3TXS1/+vvKeel1Tl7T8IGBBl0ppH9+GuY1lNkZ:OOgoEVPqNYzEcwov9YVS9uOs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4184	4764	rundll32.exe	91
PID 4764 wrote to memory of 4184	4764	rundll32.exe	91
PID 4764 wrote to memory of 4184	4764	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\073cd8f01296d2fb5e8be971e50f78f5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\073cd8f01296d2fb5e8be971e50f78f5_JaffaCakes118.dll,#1
  2⤵
  PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3904 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3556