8468496c2e594574049f1857496a30aec160a49088719bf51db7ed8658a08a75

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 10:16

Target

07eaf3519aac29dd0e931cd35f4b8bc2_JaffaCakes118.dll
Size

98KB
MD5

07eaf3519aac29dd0e931cd35f4b8bc2
SHA1

482f8a1dcbc35dfeaceb900e4c4f3072b89dd144
SHA256

8468496c2e594574049f1857496a30aec160a49088719bf51db7ed8658a08a75
SHA512

c6d3d3be3794dce9c05f9fe41fa0fbc8f55e25eddc2260337a089e0568ca29c5cd2f9a01977fd62cd4c73760c0df1b6330fec476befd6e2c31060d6f74c4a4e9
SSDEEP

3072:uEgLGv/jAcpU0oQIt1cdqMzTw3xkq3a7pEqc:JgLy/jPs1kRHw3Gq3atY

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07eaf3519aac29dd0e931cd35f4b8bc2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07eaf3519aac29dd0e931cd35f4b8bc2_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Drivers directory
  PID:1004