98ed21c31e74f5815deebcf366d955b668622dca42c60df78116c0a6c3322ea4

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:52

Target

2121c2ede8aeb845b8daf76ed70b0c7e_JaffaCakes118.dll
Size

97KB
MD5

2121c2ede8aeb845b8daf76ed70b0c7e
SHA1

45a4a7f1361811b7c522043108d824a4e69e6eec
SHA256

98ed21c31e74f5815deebcf366d955b668622dca42c60df78116c0a6c3322ea4
SHA512

5a28194be358e425c6dd74b49e8c999eecd4e0327912b18e0be39b0befbf46c23989236cae6d4d61812913281ebeed65ad818d55d2def906f9127ccb3a59f4bf
SSDEEP

3072:YB2b+5Q3+PwDw2uWexZNssnfyw7zMQXFOjcFAlIE:Y0b+kw2CnL7QQ1GcFAl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 4620	888	rundll32.exe	88
PID 888 wrote to memory of 4620	888	rundll32.exe	88
PID 888 wrote to memory of 4620	888	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2121c2ede8aeb845b8daf76ed70b0c7e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2121c2ede8aeb845b8daf76ed70b0c7e_JaffaCakes118.dll,#1
  2⤵
  PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
1⤵
PID:5088