5eb38b82eaa7ae3991975ebb95d0ea755b696889873e5469b0af422e87c1a529

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 21:51

Target

0acac995b19191f6171f746e1c80828b_JaffaCakes118.dll
Size

50KB
MD5

0acac995b19191f6171f746e1c80828b
SHA1

9f48d873bb832ce942fa1a24d2e76bc20da38138
SHA256

5eb38b82eaa7ae3991975ebb95d0ea755b696889873e5469b0af422e87c1a529
SHA512

d971db0928a090a0984f5ed60e8dbd6e00885f222759dcda61ae39f97cded194c5d96a770eb2ea3468ab7b5d89747192e3c14af09ced4260dd9c9c043904d1d1
SSDEEP

1536:jqtGLQ+nMoyh5jpTTP5OF+RgSWYkWBxc+s:jamRyTZP5mRSVfn

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\venosofu.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\forenapi	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1388	rundll32.exe
1388	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1388	2928	rundll32.exe	28
PID 2928 wrote to memory of 1388	2928	rundll32.exe	28
PID 2928 wrote to memory of 1388	2928	rundll32.exe	28
PID 2928 wrote to memory of 1388	2928	rundll32.exe	28
PID 2928 wrote to memory of 1388	2928	rundll32.exe	28
PID 2928 wrote to memory of 1388	2928	rundll32.exe	28
PID 2928 wrote to memory of 1388	2928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0acac995b19191f6171f746e1c80828b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0acac995b19191f6171f746e1c80828b_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1388

memory/1388-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1388-3-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1388-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1388-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1388-4-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1388-5-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download