62fc0e83ace8bd21811318b0abf115a7a07458c5e16f4c07a2b900537069dadf

Analysis

max time kernel
138s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 16:13

Target

16a7397c103663d632323c773787a37a_JaffaCakes118.dll
Size

340KB
MD5

16a7397c103663d632323c773787a37a
SHA1

cf198a6f2e0c6e1a7927cf750689b3cc6d36b7da
SHA256

62fc0e83ace8bd21811318b0abf115a7a07458c5e16f4c07a2b900537069dadf
SHA512

d1b52bf8347ef8d3230a3d4a5a4290e9246d583b0069e635b3103222fc168b9ae79aa0a3e98376bb3c0a7fa65640c85ab10791c69cf6671128fc6a177a2419bb
SSDEEP

3072:vvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:v206xWgGxLxWN40PDKR/JnX2P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4600 wrote to memory of 1856	4600	rundll32.exe	rundll32.exe
PID 4600 wrote to memory of 1856	4600	rundll32.exe	rundll32.exe
PID 4600 wrote to memory of 1856	4600	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16a7397c103663d632323c773787a37a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16a7397c103663d632323c773787a37a_JaffaCakes118.dll,#1
2⤵
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4432,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
1⤵
PID:764