837dfc57fd8e0bb35ce9eebf5ec5f8ae7ef48213ab290d20871088be147d96bc

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 16:49

Target

07eaf432a3f678b6fe667d29328ae466_JaffaCakes118.dll
Size

19KB
MD5

07eaf432a3f678b6fe667d29328ae466
SHA1

23fd192c0cf3e4b98d2b82126c67a776d56a8bdd
SHA256

837dfc57fd8e0bb35ce9eebf5ec5f8ae7ef48213ab290d20871088be147d96bc
SHA512

b9caeb1e90f493ed7dcdbfba63165290654f77690114df564d5a5d264c29ccf8891a71c620aae9fdf4a9359ea7a70e7c5b5b2fc127352cd1d7f9d71495527115
SSDEEP

384:pHvdDWao0yXEGHouIWSW0MSPAcjR7APtJaNmOJgi/NCYVBuyt:XW1lxCWSW0TPxyVJa0Wgi/AWt

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepion.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2904	1384	rundll32.exe	82
PID 1384 wrote to memory of 2904	1384	rundll32.exe	82
PID 1384 wrote to memory of 2904	1384	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07eaf432a3f678b6fe667d29328ae466_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07eaf432a3f678b6fe667d29328ae466_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2904

memory/2904-4-0x0000000025000000-0x0000000025022000-memory.dmp

Filesize
136KB

Download