ea71b52e071544c97b791cd9eee14ceee5a69edab78624c039d14d11d21d8aa7

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:01

Target

0ed9ba64e8b2ea3392f2619216cba148_JaffaCakes118.dll
Size

36KB
MD5

0ed9ba64e8b2ea3392f2619216cba148
SHA1

90737640c114ca11b4078397badc25d521467c92
SHA256

ea71b52e071544c97b791cd9eee14ceee5a69edab78624c039d14d11d21d8aa7
SHA512

a3caa8b15f29831aab2cac9a5cb83f91734a2c7f095a82c8b410850455c7535e65bcaa7f14f632221fc07f62f0973a6b071a09d445e46bd48b5e6d7a1f2224e5
SSDEEP

768:Gd53hJbyNbNON0lQwuXgcR1pV7Oq7Kj95hNDRR0VAZlVq:2xByNbN+eqgcRF7V7YvdR0VAzI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4972	4372	rundll32.exe	88
PID 4372 wrote to memory of 4972	4372	rundll32.exe	88
PID 4372 wrote to memory of 4972	4372	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed9ba64e8b2ea3392f2619216cba148_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed9ba64e8b2ea3392f2619216cba148_JaffaCakes118.dll,#1
  2⤵
  PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3468,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
1⤵
PID:2952