56623c693793157b1f3afd75220281018e09d7f136a62d637993b1bebe628c72

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 10:47

Target
1262b822b67ccb5ff03e0545a424ba2a_JaffaCakes118.dll
Size 1.0MB
Sample240504-mvt7eaec95
SHA256 56623c693793157b1f3afd75220281018e09d7f136a62d637993b1bebe628c72
MD5 1262b822b67ccb5ff03e0545a424ba2a
SHA1 fb60c00391a4c85e5a756e8f91b76fae9f643204
SHA512 9bc9577205e673bbd99d31fe67ba9cca824c48cc6dbf57bbee75035915677bb0c70ec97b69a151022b41109d6392c5879ee2b99d03c3c2bb4909f67b7592b56c
SSDEEP 24576:ptIAeL3+dS6Se7G8+/R8LluaKVw1B4EBGZKiGTpF+9t4+RndA44dI0ZlGOq:z2WS6J30a+RdCddC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1236	4000	rundll32.exe	91
PID 4000 wrote to memory of 1236	4000	rundll32.exe	91
PID 4000 wrote to memory of 1236	4000	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1262b822b67ccb5ff03e0545a424ba2a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1262b822b67ccb5ff03e0545a424ba2a_JaffaCakes118.dll,#1
  2⤵
  PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1332