d591b79c4c9c2548dee90255483b53198bdaafb1e772a4fd3e686f703bb21562

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 23:59

Target

23ee4d613e859915f10f80af37bacfd9_JaffaCakes118.dll
Size

14KB
MD5

23ee4d613e859915f10f80af37bacfd9
SHA1

49a41be46181b3c32f66aded5895d02a90c03500
SHA256

d591b79c4c9c2548dee90255483b53198bdaafb1e772a4fd3e686f703bb21562
SHA512

ea1456a3ed5ba0d9a28cffc93307ba1ba4eb49c5ee1b92a62dbda2f148db1b66c92960e7edda3ac36150935c44b558b2ab93e8faba37bd6293aa0ab7950c6c6c
SSDEEP

192:0PRjseE6IrFeOPbhev2Vid4XTW9yHD4SyLoYDudiiAvzh/n0:wftIrhbho2VM924Sm3udii6t

Score

1^/10

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11DB88F9-409B-475E-8FD7-411653F6D367}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11DB88F9-409B-475E-8FD7-411653F6D367}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\23ee4d613e859915f10f80af37bacfd9_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11DB88F9-409B-475E-8FD7-411653F6D367}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11DB88F9-409B-475E-8FD7-411653F6D367}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2400	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2400	2388	rundll32.exe	28
PID 2388 wrote to memory of 2400	2388	rundll32.exe	28
PID 2388 wrote to memory of 2400	2388	rundll32.exe	28
PID 2388 wrote to memory of 2400	2388	rundll32.exe	28
PID 2388 wrote to memory of 2400	2388	rundll32.exe	28
PID 2388 wrote to memory of 2400	2388	rundll32.exe	28
PID 2388 wrote to memory of 2400	2388	rundll32.exe	28
PID 2400 wrote to memory of 1364	2400	rundll32.exe	21

memory/1364-0-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/2400-2-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/2400-1-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download