0f9d39c9b64c92409fd2a36b70b50575f6e151695170b1ee5a3e2dcfe6587e7a

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 03:58

Target

1dec3079a7b70a27f17f0ec4c4da6091_JaffaCakes118.dll
Size

346KB
MD5

1dec3079a7b70a27f17f0ec4c4da6091
SHA1

247ea4be72418e74a8a373dcc3da84ec5661111e
SHA256

0f9d39c9b64c92409fd2a36b70b50575f6e151695170b1ee5a3e2dcfe6587e7a
SHA512

f304f50e20e1a97e947647d8102c0c46d644ad5d713b8b3cde7644fbb65a4120776438999c0b7d64d5952c0cca212d1ea27e75aaab69ddcedb687247bcf7af25
SSDEEP

3072:T82jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYR8r3:w2L7HN7Kl/jLA90QECrYR63

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4188 wrote to memory of 4184	4188	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 4184	4188	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 4184	4188	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dec3079a7b70a27f17f0ec4c4da6091_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dec3079a7b70a27f17f0ec4c4da6091_JaffaCakes118.dll,#1
2⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1208