88ad106027e26b2f0c63a8c63173e85318611f29d63c3a28b92729d794eef968

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 09:37

Target
1acbc86746fef86f50a970bea33601bc_JaffaCakes118.dll
Size 346KB
Sample240701-llly1axejp
SHA256 88ad106027e26b2f0c63a8c63173e85318611f29d63c3a28b92729d794eef968
MD5 1acbc86746fef86f50a970bea33601bc
SHA1 ef462ac7955f5643f91dcc73810f04aa6380d8c5
SHA512 79562a2bafbc105fcb9ed6a24c7923f03ed6f67033d23b1ed6f6b1f2cce8c05090bf75af29072ec5b66b7e0bbc728a0691abfae4c8527e5e0361817e13380c68
SSDEEP 3072:Y82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:r2L7HN7Kl/jLA90QECrYRpj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 1544	392	rundll32.exe	92
PID 392 wrote to memory of 1544	392	rundll32.exe	92
PID 392 wrote to memory of 1544	392	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acbc86746fef86f50a970bea33601bc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acbc86746fef86f50a970bea33601bc_JaffaCakes118.dll,#1
  2⤵
  PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4224