590c5874b3a79f795760b051025c537b37f03ac2de86f183dd10cd9bed71736f

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 16:04

Target

078f8a5e191e6aec217fa6f58c675d2a_JaffaCakes118.dll
Size

526KB
MD5

078f8a5e191e6aec217fa6f58c675d2a
SHA1

553f8000d819dcaf596bb7ca69bf55e29b6027e4
SHA256

590c5874b3a79f795760b051025c537b37f03ac2de86f183dd10cd9bed71736f
SHA512

3e11aac1fa0017148eceed62a610443c222d6fc3cce78fc368bca9bf24f1dbfd95337700a8f3441b69dbac5852a6ec2fcf30acf8dc8066c5ea19c6cf8a4421c6
SSDEEP

12288:IJFtyyPBEmdnAGmJ9dFsztFnSa2cTNgwI:I71EaXmFF+FnSBcTS3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2196	2112	rundll32.exe	91
PID 2112 wrote to memory of 2196	2112	rundll32.exe	91
PID 2112 wrote to memory of 2196	2112	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\078f8a5e191e6aec217fa6f58c675d2a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\078f8a5e191e6aec217fa6f58c675d2a_JaffaCakes118.dll,#1
  2⤵
  PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:2304