97254e343bf148db55cd68363848cecf4000027aad4423e7d231e4301703d60b

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 23:34

Target

0451807cfc9b18dc2d6daf0f144baa51_JaffaCakes118.dll
Size

24KB
MD5

0451807cfc9b18dc2d6daf0f144baa51
SHA1

ee10084caf70f6ec4cf6578f8e8472b7f1be8c3e
SHA256

97254e343bf148db55cd68363848cecf4000027aad4423e7d231e4301703d60b
SHA512

02fb359b4083aa9665db799c86c67925f264c4815a4e8f04423c05f148572c75e9ed4be0f0b8484db09880b066f534709d743d30bc4a5238824a343d94f30cba
SSDEEP

768:1ZTdUdAhhCS6pQDmYlGlxThMo8MzHbtZeMow:TTdV3CJpQ6t9J0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1604	628	rundll32.exe	91
PID 628 wrote to memory of 1604	628	rundll32.exe	91
PID 628 wrote to memory of 1604	628	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0451807cfc9b18dc2d6daf0f144baa51_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0451807cfc9b18dc2d6daf0f144baa51_JaffaCakes118.dll,#1
  2⤵
  PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4560