5755e253172a2824440d23b7cc41a302b2500e78c08488022b166dc493fff917

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 18:17

Target

0f0f3c02256a0495aab4fb84af87d20a_JaffaCakes118.dll
Size

186KB
MD5

0f0f3c02256a0495aab4fb84af87d20a
SHA1

b31c3af512f70eeda2ea984a5320a1b210f6fad5
SHA256

5755e253172a2824440d23b7cc41a302b2500e78c08488022b166dc493fff917
SHA512

45940ece26dbb9bcc4d81c8b0cf98042e6d4baf2c18bf73eba11c668b8100f0920c1f23d9055149f3b8fda2fc5a79622525d6cc4284ca35cca4d3a6c56ff675e
SSDEEP

3072:ziM13TBRiOvlrXnRw8PLF9jZUgpN1KEX65u6NLGkA3+WFYxe6:zi2BRiOxXRw8rZUG7KEVOSkk+WFO7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 948	372	rundll32.exe	91
PID 372 wrote to memory of 948	372	rundll32.exe	91
PID 372 wrote to memory of 948	372	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0f3c02256a0495aab4fb84af87d20a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0f3c02256a0495aab4fb84af87d20a_JaffaCakes118.dll,#1
  2⤵
  PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:1428