0b1aee796790edc39403c4d3f9388b06958a927e73fafc9dcfaf0c371f22ba04

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 13:56

Target

2298db84e8b4329fffc7c8ae1670f575_JaffaCakes118.dll
Size

122KB
MD5

2298db84e8b4329fffc7c8ae1670f575
SHA1

52d500944a045b8136730fd06faf2053a2cc5909
SHA256

0b1aee796790edc39403c4d3f9388b06958a927e73fafc9dcfaf0c371f22ba04
SHA512

1787c1e76bd54cb1f411dde1cf3bf2a7abddc3db2c0facb9fdbdec07b72a8a3303d083149814908f0c5b8d4d74ee8c6a2f8a1d0bb30e37e556d7142559d98024
SSDEEP

3072:399i7OfhO+PJx3LF01QRQYec9T3M1P/XGd04:vcaBx3LF01Cqc9svB4

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1644	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1644	4712	rundll32.exe	88
PID 4712 wrote to memory of 1644	4712	rundll32.exe	88
PID 4712 wrote to memory of 1644	4712	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2298db84e8b4329fffc7c8ae1670f575_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2298db84e8b4329fffc7c8ae1670f575_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4204,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
1⤵
PID:1584

memory/1644-1-0x00000000024C0000-0x00000000024E0000-memory.dmp

Filesize
128KB

Download
memory/1644-2-0x00000000024C0000-0x00000000024E0000-memory.dmp

Filesize
128KB

Download
memory/1644-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download