5a20bffafe8ddf121bbb49d17f0eec58cd68c2faade44b0698146493c9f6a55a

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 10:35

Target

1af7c51c902cd0c05907e83851cf2ab6_JaffaCakes118.dll
Size

36KB
MD5

1af7c51c902cd0c05907e83851cf2ab6
SHA1

4c68953fe1734b62da3040bd1f962c17456cc7ff
SHA256

5a20bffafe8ddf121bbb49d17f0eec58cd68c2faade44b0698146493c9f6a55a
SHA512

bc36018d846d5abf23755b236f9d3102045a5a2644fc178ee01e1382e77013931416db4847b597f047cb411917fdc342e69e256f85fa957aafa829eb1e580595
SSDEEP

768:0F8EQ4kt1ohfNqsDiyL8C6KnogxJzFlWJ:0F8Ekt1oSsDiyLr6SHzrW

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1844	2120	rundll32.exe	90
PID 2120 wrote to memory of 1844	2120	rundll32.exe	90
PID 2120 wrote to memory of 1844	2120	rundll32.exe	90
PID 1844 wrote to memory of 3156	1844	rundll32.exe	93
PID 1844 wrote to memory of 3156	1844	rundll32.exe	93
PID 1844 wrote to memory of 3156	1844	rundll32.exe	93
PID 3156 wrote to memory of 368	3156	net.exe	95
PID 3156 wrote to memory of 368	3156	net.exe	95
PID 3156 wrote to memory of 368	3156	net.exe	95
PID 1844 wrote to memory of 3452	1844	rundll32.exe	97
PID 1844 wrote to memory of 3452	1844	rundll32.exe	97
PID 1844 wrote to memory of 3452	1844	rundll32.exe	97
PID 3452 wrote to memory of 1608	3452	net.exe	99
PID 3452 wrote to memory of 1608	3452	net.exe	99
PID 3452 wrote to memory of 1608	3452	net.exe	99

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1af7c51c902cd0c05907e83851cf2ab6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1af7c51c902cd0c05907e83851cf2ab6_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\net.exe
    net stop winss
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winss
      4⤵
      PID:368
- - C:\Windows\SysWOW64\net.exe
    net stop OcHealthMon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OcHealthMon
      4⤵
      PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:1216

memory/1844-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1844-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1844-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1844-3-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download