b01e2166658340ffb48ec66216ffc0bb2b683b8e9a65711f521e8ecdd029103d

Analysis

max time kernel
93s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 15:54

Target

ea5af53a504a4cc9c993f88e3490adfb_JaffaCakes118.dll
Size

51KB
MD5

ea5af53a504a4cc9c993f88e3490adfb
SHA1

9337f0dbf4158f74336536d190ea4523f20c2dee
SHA256

b01e2166658340ffb48ec66216ffc0bb2b683b8e9a65711f521e8ecdd029103d
SHA512

8c0121c5643917d8c113f12ea89cc7580d415e86a6cc77bffa55ca942b7c6c6f502072c31f4993518b6ae8a6f3f9a3024095f6c2655b23ecf8700d4fbb395570
SSDEEP

1536:AuafOR3U8SEt8s4Fwr8DuxCSN1H2Glu/3ePT4XHv:AuaisEt8+rXx/jWGlu/3yTO

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Wizet\Maple\npkcrypt.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3648	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 3648	3500	rundll32.exe	84
PID 3500 wrote to memory of 3648	3500	rundll32.exe	84
PID 3500 wrote to memory of 3648	3500	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea5af53a504a4cc9c993f88e3490adfb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea5af53a504a4cc9c993f88e3490adfb_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:3648

memory/3648-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3648-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download