66032ee6684e6d4a8101d8323484092192652995cde3dda532b0134bf44def32

Analysis

max time kernel
131s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:40

Target

211a72f876d5fae0d26e44e760cb6f62_JaffaCakes118.dll
Size

31KB
MD5

211a72f876d5fae0d26e44e760cb6f62
SHA1

2db1b74b36e914a68430d9055f4e3aa259addf6e
SHA256

66032ee6684e6d4a8101d8323484092192652995cde3dda532b0134bf44def32
SHA512

08355f6e878530d8ab5e6979cef238408f5617c9fb2f3ad3564287c2d7bdca3f4fca34e928889299a433cdf4a0aa7dfde6ec3452915b5cfbaed0290cf0f0a859
SSDEEP

768:qtJWA1CqWe0PamHQ267tM/AChqDERIEjN7:ikA1kPamM7tEhkYRIEjx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1884	4812	rundll32.exe	90
PID 4812 wrote to memory of 1884	4812	rundll32.exe	90
PID 4812 wrote to memory of 1884	4812	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\211a72f876d5fae0d26e44e760cb6f62_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\211a72f876d5fae0d26e44e760cb6f62_JaffaCakes118.dll,#1
  2⤵
  PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
1⤵
PID:5072