622f1d61c0b7026198771eb9043e9043186ce261ac496badee3ece1aa4fd1a04

Analysis

max time kernel
136s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 19:00

Target

08e1aba37d6ecb2dcc7c0c6e78612bb2_JaffaCakes118.dll
Size

66KB
MD5

08e1aba37d6ecb2dcc7c0c6e78612bb2
SHA1

147bdba6d51b562664f5ffec019558249fdef4cf
SHA256

622f1d61c0b7026198771eb9043e9043186ce261ac496badee3ece1aa4fd1a04
SHA512

493c0ed22f1b18e006c21b24503f356a42af30e438602f87d594f232f5b1c8ed2317829612f2493449f6fa26864cc6a8ee6b675f3d49d715c53136e1ea5cdd62
SSDEEP

1536:kjRUhEcwwtMwFiQ8iBWw9Xj2HKryiBgqNZ9Eg/ycEW7TpdPwIHv:kF+IwF8HGSHKrbgA9E3Kn8o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1368	324	rundll32.exe	90
PID 324 wrote to memory of 1368	324	rundll32.exe	90
PID 324 wrote to memory of 1368	324	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08e1aba37d6ecb2dcc7c0c6e78612bb2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08e1aba37d6ecb2dcc7c0c6e78612bb2_JaffaCakes118.dll,#1
  2⤵
  PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2904,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:8
1⤵
PID:3084

memory/1368-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download