295b6f7f14cf28e4d29d81b66c81181acb8acaa54788f7cb7c2bbe317ce7ca35

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 01:16

Target

184104df7488d836705d72ffc4db3046_JaffaCakes118.dll
Size

204KB
MD5

184104df7488d836705d72ffc4db3046
SHA1

2c965d992549ad10ba10b3f80275c92c74ce1271
SHA256

295b6f7f14cf28e4d29d81b66c81181acb8acaa54788f7cb7c2bbe317ce7ca35
SHA512

8204511a61e679d2e3d8648004522a9980ec95fc87121ee4351a6909d3fbf7482fbe73ff24c3cf80915eb49e92a256986d384927f40402e345a7595b499fbd0e
SSDEEP

3072:/PX+LxI7GWlMZdyDIT3v9nxRJ0lb5BvoVVp/PSccmRATm/0qHkcO5VnvHrWOors7:xSm4xvootoDors3gY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1956	1764	rundll32.exe	92
PID 1764 wrote to memory of 1956	1764	rundll32.exe	92
PID 1764 wrote to memory of 1956	1764	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\184104df7488d836705d72ffc4db3046_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\184104df7488d836705d72ffc4db3046_JaffaCakes118.dll,#1
  2⤵
  PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3180 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:5012