842435c9e9935fd4268956ca780a8320e6f3710f4c41d1b2a2122c7cb735c3c7

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 03:14

Target

246fd77d0c31dabeb0eec86f19e05b5e_JaffaCakes118.dll
Size

363KB
MD5

246fd77d0c31dabeb0eec86f19e05b5e
SHA1

bf6e5e956364f81bbd6ac50e4a876a4f387b79dc
SHA256

842435c9e9935fd4268956ca780a8320e6f3710f4c41d1b2a2122c7cb735c3c7
SHA512

82182cb97e079696f8273bd7d74ad36ccdbea3f68f2bb64510d5ccfb87b75640f1c1a83417087d4842cb8db02d087e5a144e62a41aede5de49f4560a7d951741
SSDEEP

6144:Tkb52isr6KPDOsfG7S9FxPa3SWVUELfzGpjZ0jwAOaCtVvxmtD9E13u:TkF2ilSC+dCLWsfkjZaCXC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3700	1264	rundll32.exe	88
PID 1264 wrote to memory of 3700	1264	rundll32.exe	88
PID 1264 wrote to memory of 3700	1264	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\246fd77d0c31dabeb0eec86f19e05b5e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\246fd77d0c31dabeb0eec86f19e05b5e_JaffaCakes118.dll,#1
  2⤵
  PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4500,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
1⤵
PID:924

memory/3700-0-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/3700-1-0x00000000027A0000-0x00000000028A0000-memory.dmp

Filesize
1024KB

Download