82476e92bff28423e55ad7e36303b5b29744ba6a2cd1d65da949f4cf7d0f3738

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 23:17

Target

17e7cbebd54566ce956b53814fa00546_JaffaCakes118.dll
Size

7KB
MD5

17e7cbebd54566ce956b53814fa00546
SHA1

896310a95862f7b2783625ee829c79b15d613f8e
SHA256

82476e92bff28423e55ad7e36303b5b29744ba6a2cd1d65da949f4cf7d0f3738
SHA512

abf4a027782db0883bc4f361c616cbf6aa323f6686273e39181544a0ab40153dd683f3dea7a655771960ad68b0342983d4ac4513cc2070452398fb5e23105500
SSDEEP

192:p65Te1lG7UKaNmiQIC3jCmsWBv4xkgUwud:pETalG7UuiijNsWBv4+L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 224	4984	rundll32.exe	92
PID 4984 wrote to memory of 224	4984	rundll32.exe	92
PID 4984 wrote to memory of 224	4984	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17e7cbebd54566ce956b53814fa00546_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17e7cbebd54566ce956b53814fa00546_JaffaCakes118.dll,#1
  2⤵
  PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4408,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
1⤵
PID:3928

memory/224-0-0x0000000015000000-0x0000000015011000-memory.dmp

Filesize
68KB

Download