d1b556618691aaab2117adf71fb361d59e2a8c94c50e370df2c574d2ba20cd8c

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 09:11

Target

28024234c30880ecf146526ca430f9ca_JaffaCakes118.dll
Size

187KB
MD5

28024234c30880ecf146526ca430f9ca
SHA1

9e5e5dda6ff1d3e58150854c1a53f4a56c4fd7a9
SHA256

d1b556618691aaab2117adf71fb361d59e2a8c94c50e370df2c574d2ba20cd8c
SHA512

4a63eb466efd3de4f45ffdb403962271ac6b34668d81c794429f48b44136f9005c4e96119cff6b239896b57966d19e94e680ad6c974c5cb2a4bccaf636bbde32
SSDEEP

3072:NxKs2FOrVkwbgFCBXoczloK74MDsP00N9xVKGecslLUze:NxKgrVknFCuwloK+0QxVtKUz

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\__1.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\wmcache.nld	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\1.txt	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3360	2860	rundll32.exe	82
PID 2860 wrote to memory of 3360	2860	rundll32.exe	82
PID 2860 wrote to memory of 3360	2860	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28024234c30880ecf146526ca430f9ca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28024234c30880ecf146526ca430f9ca_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3360