7ddabf4e48d440b2aa71fe7115b8e4607aefea5141a3520d88dd8fad5ebf9a9e

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 15:25

Target

22d5e35b4e1770a14bb788066fd5fe83_JaffaCakes118.dll
Size

136KB
MD5

22d5e35b4e1770a14bb788066fd5fe83
SHA1

177faa6f169167f61d51a5a8e75fb722f2a78f34
SHA256

7ddabf4e48d440b2aa71fe7115b8e4607aefea5141a3520d88dd8fad5ebf9a9e
SHA512

7f9010a3cadf5e6eb091287ec3f01a3be6aefca8193dffdfdeabb9159f98ef6b8eec8b76fa57f26cdb72eb83decd9557f2b075296c0d409dbe298bbb68408a2c
SSDEEP

3072:ZDHFTuwYWNfhkw7i/MJnCcE2rrT0SUkBhgJ3oyn6c2:ZtudWNfhkw7i/MJVE2voxkXTc2

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mprmsgse.axz	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3456	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 3456	1200	rundll32.exe	83
PID 1200 wrote to memory of 3456	1200	rundll32.exe	83
PID 1200 wrote to memory of 3456	1200	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22d5e35b4e1770a14bb788066fd5fe83_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22d5e35b4e1770a14bb788066fd5fe83_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  PID:3456