191379b874ac177066df5e12db961baa5fd24fe2e7bbbe76973fedcc72d6a9e3

Analysis

max time kernel
32s
max time network
37s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:22

Target

2cd52c39aa5eb62d286ed4e31e498ca0_JaffaCakes118.dll
Size

136KB
MD5

2cd52c39aa5eb62d286ed4e31e498ca0
SHA1

7f329ba8ecda7837df8cf75f18e07546117c36d7
SHA256

191379b874ac177066df5e12db961baa5fd24fe2e7bbbe76973fedcc72d6a9e3
SHA512

9bf51711975220798e9d4e01764e0b6e2dd349ccf34640575c1ccc9e0a6f35057e765142dc385877da50d8171c17c8475c5c9cc0de3479cf1962d17acdc445ee
SSDEEP

3072:IDaEa+hRM8au82vat2cPlZuVkezMcNGBQ/Jgo9kS:Ma+hRM8au1I2cPlQuezFGwkS

Score

8^/10

Blocklisted process makes network request 3 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ormsgse.axz	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2736	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2736	2860	rundll32.exe	29
PID 2860 wrote to memory of 2736	2860	rundll32.exe	29
PID 2860 wrote to memory of 2736	2860	rundll32.exe	29
PID 2860 wrote to memory of 2736	2860	rundll32.exe	29
PID 2860 wrote to memory of 2736	2860	rundll32.exe	29
PID 2860 wrote to memory of 2736	2860	rundll32.exe	29
PID 2860 wrote to memory of 2736	2860	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cd52c39aa5eb62d286ed4e31e498ca0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cd52c39aa5eb62d286ed4e31e498ca0_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  PID:2736