097df7f1cebdfa699299ce3950220bf03a3c560b2bf9d6d098f8e4262ac8026a

Analysis

max time kernel
124s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 05:38

Target

276c15cee7c427c5daadb7f41ffb0ad3_JaffaCakes118.dll
Size

89KB
MD5

276c15cee7c427c5daadb7f41ffb0ad3
SHA1

ab71dee10f879aa88a2ea027739ae140884a087f
SHA256

097df7f1cebdfa699299ce3950220bf03a3c560b2bf9d6d098f8e4262ac8026a
SHA512

2db9d38d239ebf562e34d4da02e5a95b610ae6753f95c8b3219c803279278237f012a37f625bad8462c5ed16b4d0ce161d698a9a8d597860d15711c413baeb66
SSDEEP

1536:DxDJUblGuKOsKuMVp+y4QfUK46CweMrGhNu0thVHZVHWZ3T5:VDujnU8p+y4Bn6/xT5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4516	1888	rundll32.exe	89
PID 1888 wrote to memory of 4516	1888	rundll32.exe	89
PID 1888 wrote to memory of 4516	1888	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\276c15cee7c427c5daadb7f41ffb0ad3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\276c15cee7c427c5daadb7f41ffb0ad3_JaffaCakes118.dll,#1
  2⤵
  PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,384704133665252524,7723904513810765818,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
1⤵
PID:2460