9cff4e932a0855daf5d552fd635874f0d266b13bbcdc37e5d8b5f1e5502c4808

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 06:00

Target

24dea948d1969ae47afcd5a603958df1_JaffaCakes118.dll
Size

26KB
MD5

24dea948d1969ae47afcd5a603958df1
SHA1

ec789f2f85f52dfab280b8d50a2156832c0145f9
SHA256

9cff4e932a0855daf5d552fd635874f0d266b13bbcdc37e5d8b5f1e5502c4808
SHA512

734d60e1e436388435c421a0ea2224ad3bedff4b66e8c6f7d310f00da1d6d9652dde6fd069b468a4da515eeb637f78f80f7dfbe0d0fcd6e3af83220eb7f0638a
SSDEEP

384:a5m008E9N4NJI9LmFKZxGvAEio77bicN8oN3vZa7xh2RaRLwg7Pd:x008NI9LpZxG8o7KcuoBQ7PfRMg7Pd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 1768	436	rundll32.exe	88
PID 436 wrote to memory of 1768	436	rundll32.exe	88
PID 436 wrote to memory of 1768	436	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24dea948d1969ae47afcd5a603958df1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24dea948d1969ae47afcd5a603958df1_JaffaCakes118.dll,#1
  2⤵
  PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3848,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
1⤵
PID:2524