395a5616f1cea52e52a7a8c32d6aea73ba71bb7901760e83369de8473880857c

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 12:55

Target

1208fa5f6096b3517e94ece85fbfb49e_JaffaCakes118.dll
Size

330KB
MD5

1208fa5f6096b3517e94ece85fbfb49e
SHA1

6806867990fb6fdbe6d3216c04e512af22a92d6e
SHA256

395a5616f1cea52e52a7a8c32d6aea73ba71bb7901760e83369de8473880857c
SHA512

a729b808d224abe8f2e205a2d63cb5bff2e4a992251462149d671d76f162aa1a491c70c37141313ddd845eaadf9442a888a213f50112562df56431989168ed50
SSDEEP

3072:jRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:Fq1sFAwgwmBv3wnIgG4oAYxvU54eu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5112 wrote to memory of 1876	5112	rundll32.exe	rundll32.exe
PID 5112 wrote to memory of 1876	5112	rundll32.exe	rundll32.exe
PID 5112 wrote to memory of 1876	5112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1208fa5f6096b3517e94ece85fbfb49e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1208fa5f6096b3517e94ece85fbfb49e_JaffaCakes118.dll,#1
2⤵
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3252