ce242fd1ab4486a1729f2094072f8973fa02f3bb4131613e1800408469030704

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 14:20

Target

ed9f0223d446e04cf80269d91e2786e9_JaffaCakes118.dll
Size

31KB
MD5

ed9f0223d446e04cf80269d91e2786e9
SHA1

7037e8b40df84ee93cb54cb9d980f5f44f77ab5f
SHA256

ce242fd1ab4486a1729f2094072f8973fa02f3bb4131613e1800408469030704
SHA512

bbf6d68ea386d300a1e590d3b0a3c875f23b825d6669e95eea24dcea164217bb5c9f103fe185515b0c550ab37c41f7db7478685cd137e527135bafc7e592b003
SSDEEP

384:yTy3Q1lOsu5EZ0mDoQobchW1or/y6/+8h6xoVXYJ+IBLbq:WywO/5sCcgK/1AKVXYJ+IJW

Score

1^/10

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ed9f0223d446e04cf80269d91e2786e9_JaffaCakes118.dll"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1112	rundll32.exe
1112	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 1112	2744	rundll32.exe	83
PID 2744 wrote to memory of 1112	2744	rundll32.exe	83
PID 2744 wrote to memory of 1112	2744	rundll32.exe	83
PID 1112 wrote to memory of 3536	1112	rundll32.exe	57

memory/1112-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download