115914ae5922ff67548a623a5aa22d374ba88753e807cc0a816aec9f975daf0f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 12:36

Target

0e86290e3b6542da4b3e599434669f49_JaffaCakes118.dll
Size

294KB
MD5

0e86290e3b6542da4b3e599434669f49
SHA1

29d6ebcdc9af51a4be053e5183003d43e3a7e96c
SHA256

115914ae5922ff67548a623a5aa22d374ba88753e807cc0a816aec9f975daf0f
SHA512

ea61ffd60ca607c864e508e6c056a5fb2dbf5ad1099ae9dc61f0b77704bfc5ca60524bc1bc1c8e55215b1840551e746d8735a2ee10781a7b290172ea74052bc2
SSDEEP

6144:zXHmtfjWxBC5jFKudc65PPp7DOwQdKxSR+WJbg5VwacH:DGt2BC5RDm+PZ1QdcWpg5tg

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2008	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3004	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 3004 wrote to memory of 2008	3004	rundll32.exe	31
PID 3004 wrote to memory of 2008	3004	rundll32.exe	31
PID 3004 wrote to memory of 2008	3004	rundll32.exe	31
PID 3004 wrote to memory of 2008	3004	rundll32.exe	31
PID 3004 wrote to memory of 2008	3004	rundll32.exe	31
PID 3004 wrote to memory of 2008	3004	rundll32.exe	31
PID 3004 wrote to memory of 2008	3004	rundll32.exe	31
PID 3004 wrote to memory of 2008	3004	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e86290e3b6542da4b3e599434669f49_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e86290e3b6542da4b3e599434669f49_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    3⤵
    - Loads dropped DLL
    PID:2008

\Users\Admin\AppData\Roaming\Microsoft\bstack.dll

Filesize
43KB

MD5
f1f31c7bdc88d7efcff63dfe6cdf2ad0

SHA1
7b776bebff717b610c400e4b85e758dbc5dbc511

SHA256
9373e9ae157b3b25811efe441105b099047d0adf67426e42202f5d3acc5aa847

SHA512
1c4c8987378d438dc988e2af4e2eadf260ff527824de0402efc6ea21db34629fa949c1464402cc4712e57802eff80661c7b1633aba4ed2cc4b9d1abf154efc9a

Download Submit
memory/3004-0-0x0000000000280000-0x00000000002B9000-memory.dmp

Filesize
228KB

Download
memory/3004-5-0x0000000000280000-0x00000000002B9000-memory.dmp

Filesize
228KB

Download