f0f9c642247aad2fa2ea15357a41f67e20dc5dbad4aabd22f9cd29dd941125f0

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 23:18

Target

23cfa62b8235686a00f0012150258213_JaffaCakes118.dll
Size

28KB
MD5

23cfa62b8235686a00f0012150258213
SHA1

1e6ef8ace35998c30ffcdbc37e04f953e943a924
SHA256

f0f9c642247aad2fa2ea15357a41f67e20dc5dbad4aabd22f9cd29dd941125f0
SHA512

7946ab99a40a593aa3cdc534d0ebfd3c092ecf55c1432863521b4ac4f51b1231fb29532e4edd3791468fda24adfe073e56b37485f337937a8fc25afbd6e8af60
SSDEEP

384:jKldkIPSv3ta94mAe/39cKPQheN2qUWnm:jSkIPmta9dr9P1N2Knm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1664	4724	rundll32.exe	90
PID 4724 wrote to memory of 1664	4724	rundll32.exe	90
PID 4724 wrote to memory of 1664	4724	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23cfa62b8235686a00f0012150258213_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23cfa62b8235686a00f0012150258213_JaffaCakes118.dll,#1
  2⤵
  PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4104,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:4972