3d808ce5af99f654363684805463e6aae1466e38a276cae191adca5dd5c14894

Analysis

max time kernel
145s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 12:47

Target

ff4ef92ca7d341f8567e9d25253903cd_JaffaCakes118.dll
Size

413KB
MD5

ff4ef92ca7d341f8567e9d25253903cd
SHA1

44d9f4fe38051ad96f3f43420adce3eb31abdfa2
SHA256

3d808ce5af99f654363684805463e6aae1466e38a276cae191adca5dd5c14894
SHA512

aa18c742059824de7d061f27c96efc6db8897d7f94b8232ef264f7cd357158e634bc4b6d19a9796bc368db4b5972fbba22c92cf014015684f10984914c0743ad
SSDEEP

6144:lLnsRoovfZFAgTXUckOqeOY5xu6IuqAlcs1wpISHvWumZj8pB6Uim4pt:Zn8oOfZug7Oxixu6Irj1vWuZBfyt

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1372	rundll32.exe
1372	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1372	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1372	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1372	1724	rundll32.exe	28
PID 1724 wrote to memory of 1372	1724	rundll32.exe	28
PID 1724 wrote to memory of 1372	1724	rundll32.exe	28
PID 1724 wrote to memory of 1372	1724	rundll32.exe	28
PID 1724 wrote to memory of 1372	1724	rundll32.exe	28
PID 1724 wrote to memory of 1372	1724	rundll32.exe	28
PID 1724 wrote to memory of 1372	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff4ef92ca7d341f8567e9d25253903cd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff4ef92ca7d341f8567e9d25253903cd_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1372

memory/1372-0-0x0000000000240000-0x00000000002A5000-memory.dmp

Filesize
404KB

Download
memory/1372-1-0x0000000010000000-0x000000001014E000-memory.dmp

Filesize
1.3MB

Download
memory/1372-15-0x0000000010000000-0x000000001014E000-memory.dmp

Filesize
1.3MB

Download
memory/1372-21-0x0000000010000000-0x000000001014E000-memory.dmp

Filesize
1.3MB

Download