6556430c2278b3dfb33244c93ab68df75f2753735b5795998565174a61de6cac

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 07:14

Target

218058fb9a00acaa02ecec9f77aefebe_JaffaCakes118.dll
Size

43KB
MD5

218058fb9a00acaa02ecec9f77aefebe
SHA1

d1c124b0b8091fa8758e31a6e7584de40aab7043
SHA256

6556430c2278b3dfb33244c93ab68df75f2753735b5795998565174a61de6cac
SHA512

3fbbd8c82b4cbdd9457cac637a701bbe96172d731bf484daf23af1e9d483a62cabaff3de95fbb8aab5f3cb72896c5fd02f099eaf3a09da70544a615265ac0b09
SSDEEP

768:zkQCJuaXrYsmDrnDVaai/l1SOy8Rs6Arl5GWzwPR2Z1CAlHOAkVXT/:zkKabUnDVaxjps6AOR2TCAERT/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3184	3628	rundll32.exe	94
PID 3628 wrote to memory of 3184	3628	rundll32.exe	94
PID 3628 wrote to memory of 3184	3628	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\218058fb9a00acaa02ecec9f77aefebe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\218058fb9a00acaa02ecec9f77aefebe_JaffaCakes118.dll,#1
  2⤵
  PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4540,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
1⤵
PID:4372

memory/3184-1-0x0000000000F80000-0x0000000000F97000-memory.dmp

Filesize
92KB

Download
memory/3184-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3184-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3184-5-0x0000000000F80000-0x0000000000F97000-memory.dmp

Filesize
92KB

Download