e9f030f3303ea0c6579f5a5bcfe57e8c24d5ea080c8937a296e4908e492fb3fa

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 12:07

Target

0e028498d9e9dac6de4a1c37ef1d1ad0_JaffaCakes118.dll
Size

76KB
MD5

0e028498d9e9dac6de4a1c37ef1d1ad0
SHA1

ec7cc1c159e56e3183ce33c265a62d03c4bd862c
SHA256

e9f030f3303ea0c6579f5a5bcfe57e8c24d5ea080c8937a296e4908e492fb3fa
SHA512

3a5ebf891b4f8033518e281baa8445d2058cf08ecc9943ac5d322d53b03333a4879702d63860b6768d47e4174d80aa2c0c26d6bae8d4bccfd42ddffd6691e6b7
SSDEEP

768:kaX1PYdQXU9uTXYTzwtxOxMy/Pw1dMCPxG7JRoEptKmNikvHvmGAtqUsbyplDrod:k61QdXsTXYToo4vGXzNNisAwXbkoOw

Score

4^/10

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\web\webhp	rundll32.exe
File opened for modification	C:\Windows\web\webxs	rundll32.exe
File opened for modification	C:\Windows\web\webpf	rundll32.exe
File opened for modification	C:\Windows\web\webdc	rundll32.exe
File opened for modification	C:\Windows\web\webpt	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 4112	468	rundll32.exe	92
PID 468 wrote to memory of 4112	468	rundll32.exe	92
PID 468 wrote to memory of 4112	468	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e028498d9e9dac6de4a1c37ef1d1ad0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e028498d9e9dac6de4a1c37ef1d1ad0_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4460