4fa73741f64f6f0692aac31571fb5e555a985a01cb92788a8d4fd1db3b5eb636

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 11:16 UTC

Target

f0edc9218cea45739feff87bfbc4d97e_JaffaCakes118.dll
Size

79KB
MD5

f0edc9218cea45739feff87bfbc4d97e
SHA1

12a186592b98c140466bd9f64158218d5191af90
SHA256

4fa73741f64f6f0692aac31571fb5e555a985a01cb92788a8d4fd1db3b5eb636
SHA512

28f516ddf4fd303674f4d8c7c9634b57a8b58c2e437dae6b24e93ec783a432466fef557edf558a252368dfc2b11b219e12f555a6b9eb02f572b82707e20ad906
SSDEEP

768:WywO/5sCcgK/1AKVXYJ+IJWYuz3QLyfgPjr0QFEU2i7TQHmijOPli+B2O:1Eb1AKVXYJhW1FYPj9FEU2i/QaPx

Score

1^/10

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f0edc9218cea45739feff87bfbc4d97e_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1776	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1776	2228	rundll32.exe	30
PID 2228 wrote to memory of 1776	2228	rundll32.exe	30
PID 2228 wrote to memory of 1776	2228	rundll32.exe	30
PID 2228 wrote to memory of 1776	2228	rundll32.exe	30
PID 2228 wrote to memory of 1776	2228	rundll32.exe	30
PID 2228 wrote to memory of 1776	2228	rundll32.exe	30
PID 2228 wrote to memory of 1776	2228	rundll32.exe	30
PID 1776 wrote to memory of 1212	1776	rundll32.exe	21

memory/1212-1-0x0000000001C60000-0x0000000001C61000-memory.dmp

Filesize
4KB

Download
memory/1776-4-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1776-3-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1776-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1776-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download