9563ee4c4dc973148c569109045aa72f2dc8d7cdee4ab781d9ba87c22acb166e

Analysis

max time kernel
142s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 23:16

Target
298f73c03a1d9511647a38ac171f6fda_JaffaCakes118.dll
Size 77KB
Sample240706-28586awgnp
SHA256 9563ee4c4dc973148c569109045aa72f2dc8d7cdee4ab781d9ba87c22acb166e
MD5 298f73c03a1d9511647a38ac171f6fda
SHA1 8dbca0d5c3930f0d112efcb886b8ab11f01d4722
SHA512 03f341e0a11f514a83b7d298e90609db8ce842eace6a2e12df75d055ef0e1380fc7acb8afa2cae2f67b1e28fa9080268f0a7b5f2ed2d06bc218b7c52f5f1eb05
SSDEEP 1536:ZRmfwLMz7Kstg7YPtP9oeFwRfCa+GdVpZXbQnrI1OJ07NcY1VbM/:vcwwz7M0PtP9oeCRfCaN3pZjOJs/4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3632	436	rundll32.exe	89
PID 436 wrote to memory of 3632	436	rundll32.exe	89
PID 436 wrote to memory of 3632	436	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\298f73c03a1d9511647a38ac171f6fda_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\298f73c03a1d9511647a38ac171f6fda_JaffaCakes118.dll,#1
  2⤵
  PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,4018838247141480194,10874272319406041522,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:3304

memory/3632-0-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

Download

memory/3632-2-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/3632-3-0x0000000010000000-0x000000001000B000-memory.dmp

Download

memory/3632-6-0x0000000010000000-0x000000001000B000-memory.dmp

Download