a4c362d623147c75dcd2b9b5ba0463576e5a0a271e0d14f1dfd561df1fe5f3f6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 03:24

Target

20ebd2a9e3294fbd62add8bb5e568756_JaffaCakes118.dll
Size

18KB
MD5

20ebd2a9e3294fbd62add8bb5e568756
SHA1

12ffbf934a884c0858c9b0d3c7a03f14e6638d4e
SHA256

a4c362d623147c75dcd2b9b5ba0463576e5a0a271e0d14f1dfd561df1fe5f3f6
SHA512

2a65854e22cf6b507750f0dcd8385df59a3c8e5f0fdad9181a776904df1a8b54abdf28d761eff2d73d82951a3cff2786f6947ef9b2b4f3a8f6768b14bcb61aca
SSDEEP

192:JBv5P1RdqOs0U87+SZA5U2tqdAiDtFlNlJuXJMCIJO8DVGEeDzq6Ld:lLdZs0U8gULACDlNlJYKO3EoG

Score

1^/10

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20ebd2a9e3294fbd62add8bb5e568756_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1736	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1736	2120	rundll32.exe	28
PID 2120 wrote to memory of 1736	2120	rundll32.exe	28
PID 2120 wrote to memory of 1736	2120	rundll32.exe	28
PID 2120 wrote to memory of 1736	2120	rundll32.exe	28
PID 2120 wrote to memory of 1736	2120	rundll32.exe	28
PID 2120 wrote to memory of 1736	2120	rundll32.exe	28
PID 2120 wrote to memory of 1736	2120	rundll32.exe	28
PID 1736 wrote to memory of 1232	1736	rundll32.exe	21

memory/1232-0-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/1736-2-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download