c5f23d201543f7c65cca0457896c6d0896f4d3a1a361153f930f3b6253ccb7b7

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 16:44

Target

16bcdf5fe1524132d79b776958e577d6_JaffaCakes118.dll
Size

115KB
MD5

16bcdf5fe1524132d79b776958e577d6
SHA1

d71aef1da137cefb06aa7f45906e23ea3d39cec1
SHA256

c5f23d201543f7c65cca0457896c6d0896f4d3a1a361153f930f3b6253ccb7b7
SHA512

bc603ab4d85517de58878478bd054f2ecc2657462c6c577dba6ce3ede945ebf10fcc17b2f4f4a393c2cd22e285e8fe1d79b7439f0fb035d61540e457587883cf
SSDEEP

3072:biKXE79oAwOSxoPMVsf0nQla8vxgs2N+r3r:bDCRgPvSCsDr3r

Score

1^/10

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16bcdf5fe1524132d79b776958e577d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16bcdf5fe1524132d79b776958e577d6_JaffaCakes118.dll,#1
  2⤵
  - Modifies registry class
  PID:760

memory/760-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/760-2-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/760-1-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/760-3-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/760-4-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/760-5-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/760-7-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download