f9beace651c9d149c0b209552873555dbc2d5c65bbfacf51c54353cd5ab304ef

Analysis

max time kernel
137s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 17:07

Target
1bcec718af0a440fbd1a3a6b3e469d2d_JaffaCakes118.dll
Size 24KB
Sample240701-vmx74atbrj
SHA256 f9beace651c9d149c0b209552873555dbc2d5c65bbfacf51c54353cd5ab304ef
MD5 1bcec718af0a440fbd1a3a6b3e469d2d
SHA1 a36d5e5455e9e53c801218d4a620ec565733e43b
SHA512 e535b9911a47a1f3501e0acfe5abf350f4d796af8190a91dbd4bb5354c9d4bec79aa46b4ed4d799c81a85ddefa66243047205cdd9cfb985c310950bc10b8e458
SSDEEP 384:9eylxz0C5wDqd+1r7QK312jdWyU51v1OQXeiDpFXV02uGtWBa+atFU:9YC5KqdSfQeERmTv1RFDp1Vx+q
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bcec718af0a440fbd1a3a6b3e469d2d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bcec718af0a440fbd1a3a6b3e469d2d_JaffaCakes118.dll,#1
  2⤵
  PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4448