6f2dea10fd2fcf3afe314bd480f07c08f4ffbf211c1cc5c8634d598f4da26da3

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:34

Target
91763cf38a8073c3ed2a87511fcc2437_JaffaCakes118.dll
Size 4KB
Sample240603-ml4z9acf95
SHA256 6f2dea10fd2fcf3afe314bd480f07c08f4ffbf211c1cc5c8634d598f4da26da3
MD5 91763cf38a8073c3ed2a87511fcc2437
SHA1 40c8b21687e8b4f36f65932459568b1fff5a42f6
SHA512 11076036c69568d488cff45d7d3e8da4d913dc1c86a4a5019a73eccfa0ec3f679f88d394e53a07687a243ed6dcb0e12275712c5f2308fbaae97d86ee9e097dad
SSDEEP 48:a5z4K+cmATmRYoRZCTJzJrd/DpRe4sl8OaIBangQc:MTWnRZ0lJFpsl8j3gQc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4732	5112	rundll32.exe	92
PID 5112 wrote to memory of 4732	5112	rundll32.exe	92
PID 5112 wrote to memory of 4732	5112	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91763cf38a8073c3ed2a87511fcc2437_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91763cf38a8073c3ed2a87511fcc2437_JaffaCakes118.dll,#1
  2⤵
  PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3444,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:2320