ae3b476947ec8a3b62058aa3162fbc2f3b189c4c49c5d645c6c79922a22ebb94

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 08:36

Target
2923ce75de044c38e219c6833403ca1a_JaffaCakes118.dll
Size 89KB
Sample240509-kh2dvacb46
SHA256 ae3b476947ec8a3b62058aa3162fbc2f3b189c4c49c5d645c6c79922a22ebb94
MD5 2923ce75de044c38e219c6833403ca1a
SHA1 765876f728e070c2cc70a6a4c4c60decbcb4a4ba
SHA512 ccee9e73698aac21cb79e1d5508c5a493d53e03aa6f1e6481c6e8c4f8731d162e0a2535a97012344535c0e543a504e39755e448d560d73072c23f0ef78d3cd1e
SSDEEP 1536:H/+lis8usYy0G9LU16QZZm8NtPYOzLKNJQ4LTzrqyNwy9ZUyW3FmbJ7aY:Glis85YlMQZkotPYO6N1yyNwyDkFmlV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 2060	3740	rundll32.exe	89
PID 3740 wrote to memory of 2060	3740	rundll32.exe	89
PID 3740 wrote to memory of 2060	3740	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2923ce75de044c38e219c6833403ca1a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2923ce75de044c38e219c6833403ca1a_JaffaCakes118.dll,#1
  2⤵
  PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4312,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
1⤵
PID:3176