b01e2166658340ffb48ec66216ffc0bb2b683b8e9a65711f521e8ecdd029103d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 15:54

Target

ea5af53a504a4cc9c993f88e3490adfb_JaffaCakes118.dll
Size

51KB
MD5

ea5af53a504a4cc9c993f88e3490adfb
SHA1

9337f0dbf4158f74336536d190ea4523f20c2dee
SHA256

b01e2166658340ffb48ec66216ffc0bb2b683b8e9a65711f521e8ecdd029103d
SHA512

8c0121c5643917d8c113f12ea89cc7580d415e86a6cc77bffa55ca942b7c6c6f502072c31f4993518b6ae8a6f3f9a3024095f6c2655b23ecf8700d4fbb395570
SSDEEP

1536:AuafOR3U8SEt8s4Fwr8DuxCSN1H2Glu/3ePT4XHv:AuaisEt8+rXx/jWGlu/3yTO

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Wizet\Maple\npkcrypt.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3012	3000	rundll32.exe	28
PID 3000 wrote to memory of 3012	3000	rundll32.exe	28
PID 3000 wrote to memory of 3012	3000	rundll32.exe	28
PID 3000 wrote to memory of 3012	3000	rundll32.exe	28
PID 3000 wrote to memory of 3012	3000	rundll32.exe	28
PID 3000 wrote to memory of 3012	3000	rundll32.exe	28
PID 3000 wrote to memory of 3012	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea5af53a504a4cc9c993f88e3490adfb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea5af53a504a4cc9c993f88e3490adfb_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:3012

memory/3012-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3012-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download