214d291172d98d917f8c5da3a69b8138c87e950792f3c5a60ed348439e2d0059

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 07:34

Target

152b0210807442133e77bf10cb7b0995_JaffaCakes118.dll
Size

14KB
MD5

152b0210807442133e77bf10cb7b0995
SHA1

9ad955559010e1459f752ed1ef190144dea74631
SHA256

214d291172d98d917f8c5da3a69b8138c87e950792f3c5a60ed348439e2d0059
SHA512

3f79147d5444bf54037e8c38e7144d95f81605a4b9868f8a8e1dfa55383c6e9b944b10e3d16aab3deb25dd2b0d25ec32f4d80f981e3240b61439f83d7439ccc3
SSDEEP

384:XjodP45ss89DHYBI0TkhnsifOH1+Gc9KWyC6Kcco:X0dgWBHBgkhnskOsK2Ex

Score

1^/10

Suspicious behavior: LoadsDriver 64 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 5100	4728	rundll32.exe	91
PID 4728 wrote to memory of 5100	4728	rundll32.exe	91
PID 4728 wrote to memory of 5100	4728	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\152b0210807442133e77bf10cb7b0995_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\152b0210807442133e77bf10cb7b0995_JaffaCakes118.dll,#1
  2⤵
  PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:1576

C:\Users\Admin\AppData\Local\Temp\tmp2440.tmp

Filesize
3KB

MD5
4f4ea296395002ded10aebe87db4464d

SHA1
c1f97e1292853d4f5caaab86028ba5c91703c2f7

SHA256
0b94323c62e819624cae005e5bdbde48c0b10a10c072cc10084a734a4847c633

SHA512
2e8ec47838667a49bbea0c7a22646ea8ac0ebeaae8fb6b748cd81e7e94902a5fe7d74bbfe5d944520211a9ef4d19ffa834ae1ac142dae0744d763effa1f045c2

Download Submit
C:\name.log

Filesize
58B

MD5
5602febf87bd4c535da2d4e90f56e52b

SHA1
e563ac3a277e614480525dc60061a06afe1a0419

SHA256
569f5ce34e8e491d1b425b57cc90c1463d72eb531983727557802b17c148486b

SHA512
b0e8186706e004b800f3e554171c2a3d8c7391b5d0ba8694380fdfdd12fb09330033a1af29bdc8898a09fabad611aaa98e3deb51d2e4d6e1e0d524b673eddb0f

Download Submit
memory/5100-0-0x0000000025000000-0x000000002501C000-memory.dmp

Filesize
112KB

Download