052b2cfaafd3e657935077e43ddbf2fe84558ddf3143ffbe0b8c028548b232f7

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 23:48

Target
0ce57e90c615bd156c5b9a9059583ff9_JaffaCakes118.dll
Size 1.0MB
Sample240501-3tmzpscg87
SHA256 052b2cfaafd3e657935077e43ddbf2fe84558ddf3143ffbe0b8c028548b232f7
MD5 0ce57e90c615bd156c5b9a9059583ff9
SHA1 04d000ab4966dad8c132496032075a74dbda73af
SHA512 9b2c8bba908be7476c6187aa773195d46c42fd55bce8ef89581230f847e787c89813165035e906148b33148683dbf465c0d0f1ff2519163c1992ffe5c6003f22
SSDEEP 24576:ECChy5r/9A9+tYO0AqNzg89etxmL8Guyxe:LP/9Abzg89RL8Byxe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4660	1444	rundll32.exe	91
PID 1444 wrote to memory of 4660	1444	rundll32.exe	91
PID 1444 wrote to memory of 4660	1444	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ce57e90c615bd156c5b9a9059583ff9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ce57e90c615bd156c5b9a9059583ff9_JaffaCakes118.dll,#1
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:2976