9a0f77fa32858e2390e9f10868c79039190714160a74513f2281be531adce8a3

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 00:18

Target

2a50ac978e3d05f4205c2da51056f116_JaffaCakes118.dll
Size

2.9MB
MD5

2a50ac978e3d05f4205c2da51056f116
SHA1

87f677f5e15d44bf8ed90e3af8f2b2f1383ac9ce
SHA256

9a0f77fa32858e2390e9f10868c79039190714160a74513f2281be531adce8a3
SHA512

af840d7b2dd31dc63556e28ac001109003633e9571e9b5d12e0d9841571c5127536c88dc456149c967694c386677365ae29f967136b4e5e40e88b1cde8f0ddbe
SSDEEP

24576:G9Wy4tK/kZSIje10LH/zFOzupyVoR5r+oGbzh+ogZj9naZh1R2aTEII9bsn7drDz:GctK/ESbenhGrIihXckyhhIwMzam1

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3684	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3684	4512	rundll32.exe	89
PID 4512 wrote to memory of 3684	4512	rundll32.exe	89
PID 4512 wrote to memory of 3684	4512	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a50ac978e3d05f4205c2da51056f116_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a50ac978e3d05f4205c2da51056f116_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3896,i,5028538196072658126,13960315633709835247,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
1⤵
PID:1156