123fa1db8368fa65be1c6db323de4ae91c61234ec469edca3f125954950c4151

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 17:15

Target

081f92d8b7c7ea4d84f5bcba8de95bc9_JaffaCakes118.dll
Size

318KB
MD5

081f92d8b7c7ea4d84f5bcba8de95bc9
SHA1

029af4dbc2d1c00f482869a5fcec4b70652dec14
SHA256

123fa1db8368fa65be1c6db323de4ae91c61234ec469edca3f125954950c4151
SHA512

0b5a39c4e940814e0764d94867826360572b72c9596028bf6c98b164017247eb243d1dbb37a6be691474b2144194a040864fcd1beb0185800c621a1ab3a646d6
SSDEEP

6144:5jN1PSFPg7MWtzAgfi5bXbN13kLiyYGlayKTx3T9iJV/qPb/YV6Xfu16:5jHIPgv05bXbn3kLE1lKVQb1P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2196	2112	rundll32.exe	91
PID 2112 wrote to memory of 2196	2112	rundll32.exe	91
PID 2112 wrote to memory of 2196	2112	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\081f92d8b7c7ea4d84f5bcba8de95bc9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\081f92d8b7c7ea4d84f5bcba8de95bc9_JaffaCakes118.dll,#1
  2⤵
  PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:4848

memory/2196-0-0x0000000005060000-0x00000000050B8000-memory.dmp

Filesize
352KB

Download