a858d4ac2b427f8b0484145a6c5db5899092861f279b130443786bf5589559cd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 18:21

Target

0a199d510dc55de36f93f5d894555187_JaffaCakes118.dll
Size

174KB
MD5

0a199d510dc55de36f93f5d894555187
SHA1

eee8c34035a774c3583fcf165eb2067ba0c16e84
SHA256

a858d4ac2b427f8b0484145a6c5db5899092861f279b130443786bf5589559cd
SHA512

ad056d5e36fafc71f730a7d91a295a2165466050a818c1a739abeda429244a550c36f60d69b184e0e885a6c844c635495188fb2b0d088442be2b42cb3875b683
SSDEEP

3072:eIU+zsS3RYtVSHPNMUknMV575lEjE3KrdLwmoqqTej5mFrSRcOxciNj7jq2O79kD:RnS6HPNMUV5jGQKxLgbZSX2iNLEy

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ernel32.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ernel32.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1828	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a199d510dc55de36f93f5d894555187_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a199d510dc55de36f93f5d894555187_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1828

memory/1828-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/1828-1-0x0000000000260000-0x000000000028F000-memory.dmp

Filesize
188KB

Download
memory/1828-4-0x0000000000260000-0x000000000028F000-memory.dmp

Filesize
188KB

Download
memory/1828-5-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download