1fa242ce013b13eccbf6adeaeec9c1c42bcc23fd2a96351e43eceb39d1408475

Analysis

max time kernel
0s
max time network
1s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 04:37

Target
fbf13e38558108839059a6df1a214d03_JaffaCakes118.dll
Size 942KB
Sample240420-e9asbagf68
SHA256 1fa242ce013b13eccbf6adeaeec9c1c42bcc23fd2a96351e43eceb39d1408475
MD5 fbf13e38558108839059a6df1a214d03
SHA1 e070d3aeb6b50ae7dde84ecda504aedb2d284125
SHA512 9b95c6c7165e6c45aa66d31ea1d3dec0ea45e518c72e78dc750a86b157b1bc58c8a9c84516491ea55c6b97d6d292290185ef441c3871d7e00147d94c8a172cbb
SSDEEP 24576:5hTSqs13avB+054QYuNVGvogaiXK0xb7ZivKLVg:5hEIQQYYiXnRivKK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
880	rundll32.exe
880	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 880	2736	rundll32.exe	28
PID 2736 wrote to memory of 880	2736	rundll32.exe	28
PID 2736 wrote to memory of 880	2736	rundll32.exe	28
PID 2736 wrote to memory of 880	2736	rundll32.exe	28
PID 2736 wrote to memory of 880	2736	rundll32.exe	28
PID 2736 wrote to memory of 880	2736	rundll32.exe	28
PID 2736 wrote to memory of 880	2736	rundll32.exe	28
PID 880 wrote to memory of 1828	880	rundll32.exe	29
PID 880 wrote to memory of 1828	880	rundll32.exe	29
PID 880 wrote to memory of 1828	880	rundll32.exe	29
PID 880 wrote to memory of 1828	880	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbf13e38558108839059a6df1a214d03_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbf13e38558108839059a6df1a214d03_JaffaCakes118.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    PID:1828

rundll32Srv.exe

Path \Windows\SysWOW64\rundll32Srv.exe
Size 69KB
SHA256 f2cf33052bb9ed658351e1ff0687d0602a1f619e0976cd45852d3eb109aacf60
MD5 3284b0d95ae1f80355da5e04e79a6be1
SHA1 642bbb026f238a4eed9931772869b637621d98c8
SHA512 13712a19409818ecb66ecb2bb045a5800e4362f0ff0e9b2d158590fd501c35861ceae195f8171301ef6e72dd3b6f28184af31188836d92c171bfa6bedeb98547
SSDEEP 1536:bJupXKiER8iMQGV644h10kTYv3ZOLJ+M/DIJPlrGnWcTSy:bJuqRVQV644JcPZOdjDIJaUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/880-3-0x0000000000210000-0x0000000000269000-memory.dmp

Download

memory/880-2-0x00000000623F0000-0x00000000624E1000-memory.dmp

Download