38ad42174861ea9b4ea929347f4cf37cc80b075cad0e419f12e3b6cfafa21454

Analysis

max time kernel
128s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 09:42

Target

7c834d71a108c4da3c0a8b7af05507ad_JaffaCakes118.dll
Size

116KB
MD5

7c834d71a108c4da3c0a8b7af05507ad
SHA1

4acb781839437349e1644c769291799d7ccab255
SHA256

38ad42174861ea9b4ea929347f4cf37cc80b075cad0e419f12e3b6cfafa21454
SHA512

7d81c7204ff05ffdf09a2f0ad353fcba62f980de6e7c16bddbd9b7eb120fbf01690bd95ab991befddf2e25d71f8fb641972dfbc398c674dc6a70b295d07cb10b
SSDEEP

1536:C16uwb1/D1QQCmtfbuIZ6c4VJhTpmu3EfFxaQiXyOl6t+txUk:C18fbuIcmuwDtYyOl6t+X

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\__1.dat	rundll32.exe
File opened for modification	\??\c:\windows\SysWOW64\mswmpdat.tlb	rundll32.exe
File created	\??\c:\windows\SysWOW64\mswmpdat.tlb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\wmcache.nld	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\1.txt	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 736	4356	rundll32.exe	83
PID 4356 wrote to memory of 736	4356	rundll32.exe	83
PID 4356 wrote to memory of 736	4356	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c834d71a108c4da3c0a8b7af05507ad_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c834d71a108c4da3c0a8b7af05507ad_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:736

C:\Users\Admin\AppData\Local\Temp\6D73776D706461742E746C62FA.tmp

Filesize
163B

MD5
10ff9715be8a3ef745c27d65fc103d77

SHA1
4f58b9b8ed0215cfc73e2aa0f702840dfaea3311

SHA256
a2089e33f046b3e7a753455c12d21b8030aeb0dab6c147ed0017e51d57c8fe34

SHA512
97999cba6941e10ce2de4a0ef43cb16231cb7940a8dbb7731ff4e25b002d141d7e0c91438f53b67bce42e03000bba4f392dc4550209f37bc79d3eb7c2e7a40aa

Download Submit