2ec4721dceb84fda30fe482b8792746d3f6f83ecbc262072af94258a911c5226

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 00:37

Target

2a5daeb8726117911b8a5fb1f3e8471f_JaffaCakes118.dll
Size

19KB
MD5

2a5daeb8726117911b8a5fb1f3e8471f
SHA1

e435c8f00eab74a245d2cc521446a02c340d3301
SHA256

2ec4721dceb84fda30fe482b8792746d3f6f83ecbc262072af94258a911c5226
SHA512

adb11974e1aebb6fb005a13be63d68f2ac5b4026d5efe61af6fb1cdccdf10324402dcc4cec32146308a76115e42e8272f67e1fcc64bc590205534b464ca0b40c
SSDEEP

384:7nKVGRso8u2FFHhNKvX+3nWQOHVhMwND34mKq5wDiHQuq/FV:7KVCH8uifNnWQwGwNlKq5w+wua

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RemoteDbg.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\RemoteDbg.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	1844	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1844	rundll32.exe
1844	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1844	1900	rundll32.exe	30
PID 1900 wrote to memory of 1844	1900	rundll32.exe	30
PID 1900 wrote to memory of 1844	1900	rundll32.exe	30
PID 1900 wrote to memory of 1844	1900	rundll32.exe	30
PID 1900 wrote to memory of 1844	1900	rundll32.exe	30
PID 1900 wrote to memory of 1844	1900	rundll32.exe	30
PID 1900 wrote to memory of 1844	1900	rundll32.exe	30
PID 1844 wrote to memory of 2404	1844	rundll32.exe	31
PID 1844 wrote to memory of 2404	1844	rundll32.exe	31
PID 1844 wrote to memory of 2404	1844	rundll32.exe	31
PID 1844 wrote to memory of 2404	1844	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a5daeb8726117911b8a5fb1f3e8471f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a5daeb8726117911b8a5fb1f3e8471f_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 220
    3⤵
    - Program crash
    PID:2404

memory/1844-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1844-3-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1844-2-0x000000001000F000-0x0000000010010000-memory.dmp

Filesize
4KB

Download
memory/1844-4-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download