7db2b4a1b2847cb8af7be87897e9f5fa71e75e151b9860b74b3b473386b5cef3

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 23:49

Target

2e44701a14986e0d82431926680d721d_JaffaCakes118.dll
Size

77KB
MD5

2e44701a14986e0d82431926680d721d
SHA1

025b225b6f39d1791895108ea19632b7362ce8ca
SHA256

7db2b4a1b2847cb8af7be87897e9f5fa71e75e151b9860b74b3b473386b5cef3
SHA512

12cb116287895f6ef92cbf7c6c92031b7dd79b1201f2dcd78d47a320470c39faec28129ec482a0402f1994f84fcfe8f196d22f0f341f1a2ccbab98b43d615fb6
SSDEEP

1536:/9mNIOy5o7v+8JEkAixo2CaJCvFuZ4YOqSlE3ZbHYjkxbFKIn8gp2:Wy5oD+L7faJCvFfUYOTHtFKI8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 396	4436	rundll32.exe	89
PID 4436 wrote to memory of 396	4436	rundll32.exe	89
PID 4436 wrote to memory of 396	4436	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e44701a14986e0d82431926680d721d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e44701a14986e0d82431926680d721d_JaffaCakes118.dll,#1
  2⤵
  PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4104,i,8550138573348074061,7308779696487990535,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:4036

memory/396-0-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download