671d1378bc32afb782c7e5f00de190abc59e461cc9dc49757ce1a80e6f81c8dd

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 17:07

Target

09c4b93fa89ebc37f3537c717dbdca62_JaffaCakes118.dll
Size

740KB
MD5

09c4b93fa89ebc37f3537c717dbdca62
SHA1

0ff65efd04768005883167ee34d1efa49fd7e645
SHA256

671d1378bc32afb782c7e5f00de190abc59e461cc9dc49757ce1a80e6f81c8dd
SHA512

c5b30e1b3b3088bc2e591b8592cd4d7e3120ea4806021bd060647806e5e22e61c5efda420d7537819b39d8d19765e1bd706bcb70758ce09d33b62a6af3153915
SSDEEP

12288:E/rQzV4mwS1mrqQr+TSGNisfLqHd1XTWXPMUVWyMNrpOjWtGNgDUiWqWNKDrt2:E8zV4mKV2UsfLCd9RUyN1OjWcCDUiWBp

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	rundll32.exe
4740	rundll32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4740	4076	rundll32.exe	91
PID 4076 wrote to memory of 4740	4076	rundll32.exe	91
PID 4076 wrote to memory of 4740	4076	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c4b93fa89ebc37f3537c717dbdca62_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c4b93fa89ebc37f3537c717dbdca62_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4904

memory/4740-0-0x0000000010000000-0x0000000010264000-memory.dmp

Filesize
2.4MB

Download
memory/4740-1-0x0000000010000000-0x0000000010264000-memory.dmp

Filesize
2.4MB

Download
memory/4740-6-0x0000000010000000-0x0000000010264000-memory.dmp

Filesize
2.4MB

Download