67c771d4d01def6147dd8571c079ea2ea6882ee833cbd5762204f4777dba10ce

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 00:04

Target

61645330c61a316c542aad1ef828847a_JaffaCakes118.dll
Size

1.3MB
MD5

61645330c61a316c542aad1ef828847a
SHA1

1700ec5dc4f28e0bc6130130a12200bff68d2e32
SHA256

67c771d4d01def6147dd8571c079ea2ea6882ee833cbd5762204f4777dba10ce
SHA512

0c55e3df80c89d67ed6df9f6d5582b5a1fbd0f6d61fc2aae824d216209a45ae7af20dd2ca5b7daf2cf79feebe9da933225688b64674a6135935ec3776fa3e7d2
SSDEEP

24576:QlJLVH14k9zWnWM2SSEQWmQVyddaoHQEQOeS/riT52c:uJN1RFl0Qd9IfS/r052c

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2144	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SmileEDI\logs\20240521.log	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SmileEDI\logs\20240521.log	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2144	1260	rundll32.exe	28
PID 1260 wrote to memory of 2144	1260	rundll32.exe	28
PID 1260 wrote to memory of 2144	1260	rundll32.exe	28
PID 1260 wrote to memory of 2144	1260	rundll32.exe	28
PID 1260 wrote to memory of 2144	1260	rundll32.exe	28
PID 1260 wrote to memory of 2144	1260	rundll32.exe	28
PID 1260 wrote to memory of 2144	1260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61645330c61a316c542aad1ef828847a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61645330c61a316c542aad1ef828847a_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  PID:2144

memory/2144-0-0x0000000000540000-0x0000000000697000-memory.dmp

Filesize
1.3MB

Download
memory/2144-1-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download