4c3b6b660c93494101412f0eb08be8b6e0854574dbb31cb4c87fab8bd52fb980

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 09:45

Target

2fe0a490a2a3edb9ff62841e09713f2c_JaffaCakes118.dll
Size

25KB
MD5

2fe0a490a2a3edb9ff62841e09713f2c
SHA1

99ea83786825cb5df5eb95a2dc708a67d9053133
SHA256

4c3b6b660c93494101412f0eb08be8b6e0854574dbb31cb4c87fab8bd52fb980
SHA512

94b23a3afa4e1b119165d59ccdf7c75b50e49f3d8b626aff3f4bb6734cce740cb947b7d9fe9beb7494806d207889c79e3bbe506eb10f95d88d2a71479033fec6
SSDEEP

384:PqRUX8rexMxqz3EB9Ln1L1LzTU/0vzmY/JJO7DY0vBsisp2o:PCFqisz3Ud1L1XTUc6YTV0S

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2984	4052	rundll32.exe	89
PID 4052 wrote to memory of 2984	4052	rundll32.exe	89
PID 4052 wrote to memory of 2984	4052	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fe0a490a2a3edb9ff62841e09713f2c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fe0a490a2a3edb9ff62841e09713f2c_JaffaCakes118.dll,#1
  2⤵
  PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4160,i,270339169963605285,17552719617811964021,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
1⤵
PID:2544

memory/2984-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2984-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download