a1f04def11ea04671d6309926643fd93697d09a1ae45d19c8569f61811ae3665

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 20:22

Target

1c5f8eab42b22410099ba90f5686db02_JaffaCakes118.dll
Size

80KB
MD5

1c5f8eab42b22410099ba90f5686db02
SHA1

a9934085f6eba5f1dab775b5fffa3ad471ceeb68
SHA256

a1f04def11ea04671d6309926643fd93697d09a1ae45d19c8569f61811ae3665
SHA512

f077e40847a5c66238f5ccc99246944506a4cca2a469f169c35631af8db6ab63c74f8e91dfded73415fc834dd4fd84a899c3600f68fc6524094676d6495d7e0c
SSDEEP

1536:3jAAspKlw2IHm3ARoRyjdUWHK+APJSD0VbMhdZJXi0CzBVJxpkTFSDgUamC64HdU:EAspK62IHm3ARoRyjdUWHK+APJSD0VbL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2100	2240	rundll32.exe	90
PID 2240 wrote to memory of 2100	2240	rundll32.exe	90
PID 2240 wrote to memory of 2100	2240	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c5f8eab42b22410099ba90f5686db02_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c5f8eab42b22410099ba90f5686db02_JaffaCakes118.dll,#1
  2⤵
  PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2880

memory/2100-0-0x000000006D560000-0x000000006D579000-memory.dmp

Filesize
100KB

Download