81843d34ea083f32e450d454b8326d86d5acf9c02511dcc1cb3764ed44ac1432

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 02:55

Target
146c72828175526e09064857db2be5a5_JaffaCakes118.dll
Size 55KB
Sample240627-dewkvs1hpk
SHA256 81843d34ea083f32e450d454b8326d86d5acf9c02511dcc1cb3764ed44ac1432
MD5 146c72828175526e09064857db2be5a5
SHA1 9debb7f08efa71a2524dc70b9c5dda410a1cb9fd
SHA512 c26e7405a5f5865d88534204750f7da81ce08f098d52ab6c3b5691038d8d3e78c06715547351df1e7639a56c6f4474fe183777c0576b193edc24fd39b9dbff75
SSDEEP 768:Nos4AsNUzi7d/F1E3gJZJwGBtaKn/PrSvEYW5peM1ovi/ICe:Nogw7dN+3gtaY3rSc7eM8CICe
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\divomobi.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sanuzasi	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4888	rundll32.exe
4888	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4888	2180	rundll32.exe	81
PID 2180 wrote to memory of 4888	2180	rundll32.exe	81
PID 2180 wrote to memory of 4888	2180	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\146c72828175526e09064857db2be5a5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\146c72828175526e09064857db2be5a5_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:4888

memory/4888-1-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/4888-0-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/4888-2-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/4888-3-0x0000000010000000-0x000000001001F000-memory.dmp

Download