115914ae5922ff67548a623a5aa22d374ba88753e807cc0a816aec9f975daf0f

Analysis

max time kernel
138s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 12:36

Target

0e86290e3b6542da4b3e599434669f49_JaffaCakes118.dll
Size

294KB
MD5

0e86290e3b6542da4b3e599434669f49
SHA1

29d6ebcdc9af51a4be053e5183003d43e3a7e96c
SHA256

115914ae5922ff67548a623a5aa22d374ba88753e807cc0a816aec9f975daf0f
SHA512

ea61ffd60ca607c864e508e6c056a5fb2dbf5ad1099ae9dc61f0b77704bfc5ca60524bc1bc1c8e55215b1840551e746d8735a2ee10781a7b290172ea74052bc2
SSDEEP

6144:zXHmtfjWxBC5jFKudc65PPp7DOwQdKxSR+WJbg5VwacH:DGt2BC5RDm+PZ1QdcWpg5tg

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4580	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3864	4676	rundll32.exe	84
PID 4676 wrote to memory of 3864	4676	rundll32.exe	84
PID 4676 wrote to memory of 3864	4676	rundll32.exe	84
PID 3864 wrote to memory of 4580	3864	rundll32.exe	111
PID 3864 wrote to memory of 4580	3864	rundll32.exe	111
PID 3864 wrote to memory of 4580	3864	rundll32.exe	111
PID 3864 wrote to memory of 4580	3864	rundll32.exe	111

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e86290e3b6542da4b3e599434669f49_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e86290e3b6542da4b3e599434669f49_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    3⤵
    - Loads dropped DLL
    PID:4580

C:\Users\Admin\AppData\Roaming\Microsoft\bstack.dll

Filesize
60KB

MD5
174d921f1387b534ee96dc294b79fb3f

SHA1
7dad0fd02fa624373fc411c541d9391275c6dba3

SHA256
dc7f1117328a8d68d3904daad34bcbb9675177ba1a507f0da13436874f881324

SHA512
35724d8a4c458854d1cd7ca773abaea2b548aea2cb8b345e1b2eae86fc178b2c17c52e0f4f173fa2419b31337a2e6f090195f23d9587c5dfd1851c7c556d0b4d

Download Submit
memory/3864-0-0x00000000012E0000-0x0000000001319000-memory.dmp

Filesize
228KB

Download
memory/3864-5-0x00000000012E0000-0x0000000001319000-memory.dmp

Filesize
228KB

Download