4b65269980baec91e1a5babc7b4cb0cb70aa595ffd07c8731bd0af83f0671225

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 18:03

Target

2b355c8cae7cc25ac7102ba38d126270_JaffaCakes118.dll
Size

8KB
MD5

2b355c8cae7cc25ac7102ba38d126270
SHA1

69eea1a76ee9a6b02f1f0300e989f5a01b840079
SHA256

4b65269980baec91e1a5babc7b4cb0cb70aa595ffd07c8731bd0af83f0671225
SHA512

54902ece423c7284eec730f58a7e70afa27f70de1742eec8830d2cde5ba15dfac739a0f4b19619172904f7c246859307c728090f0c538789edc33d20c6bbabfb
SSDEEP

192:jnzXVl+ysFm+2pZ566OZufB4oo98h9Yp+tnWFka:rzRsFm5pSrg5IKPYpqnWFka

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\msgsocm.log	rundll32.exe
File opened for modification	C:\Windows\msgsocm.log	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1548	1368	rundll32.exe	28
PID 1368 wrote to memory of 1548	1368	rundll32.exe	28
PID 1368 wrote to memory of 1548	1368	rundll32.exe	28
PID 1368 wrote to memory of 1548	1368	rundll32.exe	28
PID 1368 wrote to memory of 1548	1368	rundll32.exe	28
PID 1368 wrote to memory of 1548	1368	rundll32.exe	28
PID 1368 wrote to memory of 1548	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b355c8cae7cc25ac7102ba38d126270_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b355c8cae7cc25ac7102ba38d126270_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  PID:1548

memory/1548-0-0x00000000608D0000-0x00000000608D9000-memory.dmp

Filesize
36KB

Download
memory/1548-2-0x00000000608D7000-0x00000000608D8000-memory.dmp

Filesize
4KB

Download
memory/1548-3-0x00000000608D0000-0x00000000608D9000-memory.dmp

Filesize
36KB

Download