dd44aa9b4da39c05dc3fe07f5a1aa97f5f76bc52d3c6b68fdb3074a189f01c0e

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:40

Target

060f84064c144331b3c7622884a0fdd0_JaffaCakes118.dll
Size

77KB
MD5

060f84064c144331b3c7622884a0fdd0
SHA1

ed51b7319b043a7c870a55d27ef7f7047928f348
SHA256

dd44aa9b4da39c05dc3fe07f5a1aa97f5f76bc52d3c6b68fdb3074a189f01c0e
SHA512

33bdb925928781084016f0dcf3b764d2a8d086843679058d6f9e294f20ab564e743ebe2aac19189b9fd1e3aed6d7df5291bf4f1734755b11d2d141064442cf8a
SSDEEP

1536:y+ZM1kuPdl2kQ4NcR5ifL8eFi2q2O9IsbeuMJ:ykIk/X4Ni50L8eF9lO9Isbw

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beEp.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\060f84064c144331b3c7622884a0fdd0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\060f84064c144331b3c7622884a0fdd0_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Drivers directory
  PID:2748