38ad42174861ea9b4ea929347f4cf37cc80b075cad0e419f12e3b6cfafa21454

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 09:42

Target

7c834d71a108c4da3c0a8b7af05507ad_JaffaCakes118.dll
Size

116KB
MD5

7c834d71a108c4da3c0a8b7af05507ad
SHA1

4acb781839437349e1644c769291799d7ccab255
SHA256

38ad42174861ea9b4ea929347f4cf37cc80b075cad0e419f12e3b6cfafa21454
SHA512

7d81c7204ff05ffdf09a2f0ad353fcba62f980de6e7c16bddbd9b7eb120fbf01690bd95ab991befddf2e25d71f8fb641972dfbc398c674dc6a70b295d07cb10b
SSDEEP

1536:C16uwb1/D1QQCmtfbuIZ6c4VJhTpmu3EfFxaQiXyOl6t+txUk:C18fbuIcmuwDtYyOl6t+X

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\__1.dat	rundll32.exe
File opened for modification	\??\c:\windows\SysWOW64\mswmpdat.tlb	rundll32.exe
File created	\??\c:\windows\SysWOW64\mswmpdat.tlb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\wmcache.nld	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\1.txt	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3028	3000	rundll32.exe	28
PID 3000 wrote to memory of 3028	3000	rundll32.exe	28
PID 3000 wrote to memory of 3028	3000	rundll32.exe	28
PID 3000 wrote to memory of 3028	3000	rundll32.exe	28
PID 3000 wrote to memory of 3028	3000	rundll32.exe	28
PID 3000 wrote to memory of 3028	3000	rundll32.exe	28
PID 3000 wrote to memory of 3028	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c834d71a108c4da3c0a8b7af05507ad_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c834d71a108c4da3c0a8b7af05507ad_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3028

C:\Windows\SysWOW64\mswmpdat.tlb

Filesize
163B

MD5
971b90bea6f225167450e9ecb8ef26b5

SHA1
382bcba122aa440982b11a6aebc775de307c7223

SHA256
c6f986a4b4c5107b05b1a902b47d2efd728b66064a3269764d28c0870083defc

SHA512
407648a2a4523b0d12e0a3b9211ae742525ef88730cba8c250045ea566f4e9dd9b34a5ee8980493c2e6ab439fd457e908a71dd5a1139ccbcdc4bdf1d5ef07def

Download Submit