aa3d9019572edd3dccb785ac5591420c39c954bee3bf69b04ceddac66437f4bc

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 16:50

Target

1bc2e5d17ab0b0dfeaeec0f27e54dfce_JaffaCakes118.dll
Size

330KB
MD5

1bc2e5d17ab0b0dfeaeec0f27e54dfce
SHA1

048c63d5b4c14cbfd00246e030c21b2e01803e3a
SHA256

aa3d9019572edd3dccb785ac5591420c39c954bee3bf69b04ceddac66437f4bc
SHA512

b10868935924369fb5a8632a05863562026fde777e1a899ba241cc2d724cceb2954884257cac8c0a00f22e7e09dc426eb8bb696b3e8d48f9df9da1e36b6caf3c
SSDEEP

3072:ZRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:7q1sFAwgwmBv3wnIgG4oAYxvU54eu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4860 wrote to memory of 2992	4860	rundll32.exe	rundll32.exe
PID 4860 wrote to memory of 2992	4860	rundll32.exe	rundll32.exe
PID 4860 wrote to memory of 2992	4860	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bc2e5d17ab0b0dfeaeec0f27e54dfce_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bc2e5d17ab0b0dfeaeec0f27e54dfce_JaffaCakes118.dll,#1
2⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4600