06f55085d8104f4cb453e92434616168740eccc836d7ecdf1fbccaf2a85abc8d

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 23:47

Target
52171da989e6bc2d3097c3911e3370d1_JaffaCakes118.dll
Size 1.0MB
Sample240517-3ste4ahe37
SHA256 06f55085d8104f4cb453e92434616168740eccc836d7ecdf1fbccaf2a85abc8d
MD5 52171da989e6bc2d3097c3911e3370d1
SHA1 e1748a6606d332a938377ad04d73827ef0121803
SHA512 be050555fd87b2e05d99def2ad0655c4744953d3667a55b8aa56847880d4df3e2a86af59a41011b2923b4200549aca51e316fdba58943d1950d242003e1fa047
SSDEEP 24576:hDRzZ5ljxIwpxxfJlWT8zCLQPCGzXjQPWYJqVL1xcpu:bfIwpxvzC0Xjc1OaI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 2000	3232	rundll32.exe	91
PID 3232 wrote to memory of 2000	3232	rundll32.exe	91
PID 3232 wrote to memory of 2000	3232	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\52171da989e6bc2d3097c3911e3370d1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\52171da989e6bc2d3097c3911e3370d1_JaffaCakes118.dll,#1
  2⤵
  PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4140