d616306b4bbe2f0d90f2674463b56aad7a19fc60fdf795474557fa4f0275e31e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 04:46

Target

fbf51c7c96f11de65107b212f9de7e17_JaffaCakes118.dll
Size

78KB
MD5

fbf51c7c96f11de65107b212f9de7e17
SHA1

5572d667d1982384636b1e362bcf2637875fb343
SHA256

d616306b4bbe2f0d90f2674463b56aad7a19fc60fdf795474557fa4f0275e31e
SHA512

3ed6b63ff7ece87d2426112d09040ee43ce35cd4486a6698b0a0f7d01e9387528002552544b0dcd0eb690458e9b34845b84b6578b0180f401e62e242f0a31c3e
SSDEEP

1536:booPRANY2D80BmIZcaXiILWYrOdmfoo//Hi7ThMUy1y/fOBhVw52OevA:bo4RADnmIZc0SYmmJ//HETWk/fOOw4

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepion.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbf51c7c96f11de65107b212f9de7e17_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbf51c7c96f11de65107b212f9de7e17_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1352

memory/1352-0-0x0000000025000000-0x0000000025064000-memory.dmp

Filesize
400KB

Download
memory/1352-1-0x0000000025000000-0x0000000025064000-memory.dmp

Filesize
400KB

Download