e7d58bf051b2020e2ffab143e64867c1c752f2f53e41b7213187291396a68ff4

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 06:02

Target
164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll
Size 1.0MB
Sample240505-grzd3acd62
SHA256 e7d58bf051b2020e2ffab143e64867c1c752f2f53e41b7213187291396a68ff4
MD5 164d3eb9295c58aa47f7184482e837c6
SHA1 8dd418f665e6d0b3d9ad06dc5c0a0291283c9d7d
SHA512 e480adf4796fe72f4fef227cf450c552189ddfa52a14ea92c0009362b1824845d8d70c9c0683177022d47d920246549e48adea043e5a9c79a76faefac8282de1
SSDEEP 24576:RgDKNwzqg57SKQeNbhq0HgKsOwYGLD0MCg:67qg57Jjq05sO+W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2772	4656	rundll32.exe	91
PID 4656 wrote to memory of 2772	4656	rundll32.exe	91
PID 4656 wrote to memory of 2772	4656	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll,#1
  2⤵
  PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2484