0a3c5f14cf1c5b407eff0ba82bbedb4fecf3424b83e6ad9de57a2686d8e2ead7

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 09:01

Target

0d78164d74261aec517062775c8e32de_JaffaCakes118.dll
Size

132KB
MD5

0d78164d74261aec517062775c8e32de
SHA1

9a458c2df0ca4f835901a0e8ae96a3f576a8e1ed
SHA256

0a3c5f14cf1c5b407eff0ba82bbedb4fecf3424b83e6ad9de57a2686d8e2ead7
SHA512

b52fe335027f96033e25c2f9ef6267ab547a28a9cd77b706f5dace2ece850545a3456a450da42029b9ad7b44f98b6f17da8b0a53320bab7b2dccaa49e9e2d639
SSDEEP

3072:6k8NtkOnHL0FjUo5xcgVMBlNEZFLFHqukkkkfkkkk4kkkZkk:utnro5dMBeDkkkkfkkkk4kkkZkk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 1992	3888	rundll32.exe	89
PID 3888 wrote to memory of 1992	3888	rundll32.exe	89
PID 3888 wrote to memory of 1992	3888	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d78164d74261aec517062775c8e32de_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d78164d74261aec517062775c8e32de_JaffaCakes118.dll,#1
  2⤵
  PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:4300

memory/1992-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1992-5-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1992-6-0x0000000002900000-0x0000000002913000-memory.dmp

Filesize
76KB

Download
memory/1992-7-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download