a51334365e45ac5269ed16d1c9604199c507c748e8ec297617a302f561d735f5

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 03:41

Target

148dfd1365b52acb2276ce5cb1d2b122_JaffaCakes118.dll
Size

32KB
MD5

148dfd1365b52acb2276ce5cb1d2b122
SHA1

a09d7f5629f2025c277d13a17e198d9bf1455911
SHA256

a51334365e45ac5269ed16d1c9604199c507c748e8ec297617a302f561d735f5
SHA512

1f9e3e1a71af643a32f11daf860a1b966c00c3aa09b87a8f52b98e355bc571166bb6999b41a1484c57dca502bcb5e929d6a3ac6ee6acf9ba01e332386015a667
SSDEEP

768:a1QWtHd8PZIaaN5kD75KINzhqDmRCkIXL:a1dHoIaaG7559kqRCzb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4660	1188	rundll32.exe	89
PID 1188 wrote to memory of 4660	1188	rundll32.exe	89
PID 1188 wrote to memory of 4660	1188	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148dfd1365b52acb2276ce5cb1d2b122_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\148dfd1365b52acb2276ce5cb1d2b122_JaffaCakes118.dll,#1
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:720