c0292f976bda52714f6b2f9d7c7a36ad351c5c38a99bfe7599da471e5168295b

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 23:46

Target

13ef12fa3d06f6dc4307eb4b412601af_JaffaCakes118.dll
Size

340KB
MD5

13ef12fa3d06f6dc4307eb4b412601af
SHA1

0605486b7bfd9832f04e89c22acfe5951ea98214
SHA256

c0292f976bda52714f6b2f9d7c7a36ad351c5c38a99bfe7599da471e5168295b
SHA512

c3d2756a54b481e1328a5bf3f72a22df9e847aa6d524190b4f58b7539cb94581fa14781de36c8420dc1f9cda89eb7cb6ed4fb3f49526db4e4a45c873183acc37
SSDEEP

3072:WvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:W206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4544 wrote to memory of 3352	4544	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 3352	4544	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 3352	4544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13ef12fa3d06f6dc4307eb4b412601af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13ef12fa3d06f6dc4307eb4b412601af_JaffaCakes118.dll,#1
2⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4568