2c33ffd7d15297cddb7b93155847d2616d21a5db479dede08a502aa23304849f

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 15:32

Target

28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll
Size

32KB
MD5

28aa550f0f4837b58471a72b33ce9caf
SHA1

f01ad4ac1dcf3bbff44f6792569db11f81308bcc
SHA256

2c33ffd7d15297cddb7b93155847d2616d21a5db479dede08a502aa23304849f
SHA512

2b583001e3550d9e9d1cf53890ce0bc0135658b331e27bb5dc3a4bfe8e9f4feca8fe4411506b02eec4602cee62c92d24584e810203d2b9ef722e4bd7c1085ff4
SSDEEP

768:Kg/qQ5tk1RdmvWw7Ot+1kjWNqOmESRnZ+9b:Kg/D5a7dmX7OtUu3RZ+5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1796	2992	rundll32.exe	89
PID 2992 wrote to memory of 1796	2992	rundll32.exe	89
PID 2992 wrote to memory of 1796	2992	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll,#1
  2⤵
  PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,10426317566413639638,17907471819827662535,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
1⤵
PID:3776