98e2bfd096ee4bcf9d74e98fd5dfb1022595e13df7b1cfa46ca69a307f653788

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 10:16

Target

21fd29135f3eab0c3761f2f1604de4ba_JaffaCakes118.dll
Size

64KB
MD5

21fd29135f3eab0c3761f2f1604de4ba
SHA1

d1cf69b50a884ed1151ee15eb32863a92fc148e0
SHA256

98e2bfd096ee4bcf9d74e98fd5dfb1022595e13df7b1cfa46ca69a307f653788
SHA512

c83aeba4ce11eb35eeb4be94c3f7b3857b5e23e820cb5cc321b929e7fde7496d1a93e08ed9d4e7acd3916b2ff0a78aa85f0ae98d57df64cd884ef7834899a0e3
SSDEEP

768:kHLEjXqOcy48wA+LkoqW8lyTxkw9U2p26wbzC5sdxMjiB9UQgwWHiGOs3qk:kWaC+Ltq1lyTCM8nzN4los6k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1672	4604	rundll32.exe	88
PID 4604 wrote to memory of 1672	4604	rundll32.exe	88
PID 4604 wrote to memory of 1672	4604	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21fd29135f3eab0c3761f2f1604de4ba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21fd29135f3eab0c3761f2f1604de4ba_JaffaCakes118.dll,#1
  2⤵
  PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3748,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:752