9563ee4c4dc973148c569109045aa72f2dc8d7cdee4ab781d9ba87c22acb166e

Analysis

max time kernel
142s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 23:16

Target

298f73c03a1d9511647a38ac171f6fda_JaffaCakes118.dll
Size

77KB
MD5

298f73c03a1d9511647a38ac171f6fda
SHA1

8dbca0d5c3930f0d112efcb886b8ab11f01d4722
SHA256

9563ee4c4dc973148c569109045aa72f2dc8d7cdee4ab781d9ba87c22acb166e
SHA512

03f341e0a11f514a83b7d298e90609db8ce842eace6a2e12df75d055ef0e1380fc7acb8afa2cae2f67b1e28fa9080268f0a7b5f2ed2d06bc218b7c52f5f1eb05
SSDEEP

1536:ZRmfwLMz7Kstg7YPtP9oeFwRfCa+GdVpZXbQnrI1OJ07NcY1VbM/:vcwwz7M0PtP9oeCRfCaN3pZjOJs/4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3632	436	rundll32.exe	89
PID 436 wrote to memory of 3632	436	rundll32.exe	89
PID 436 wrote to memory of 3632	436	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\298f73c03a1d9511647a38ac171f6fda_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\298f73c03a1d9511647a38ac171f6fda_JaffaCakes118.dll,#1
  2⤵
  PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,4018838247141480194,10874272319406041522,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:3304

memory/3632-0-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

Filesize
48KB

Download
memory/3632-2-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/3632-3-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/3632-6-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download