191379b874ac177066df5e12db961baa5fd24fe2e7bbbe76973fedcc72d6a9e3

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 15:22

Target

2cd52c39aa5eb62d286ed4e31e498ca0_JaffaCakes118.dll
Size

136KB
MD5

2cd52c39aa5eb62d286ed4e31e498ca0
SHA1

7f329ba8ecda7837df8cf75f18e07546117c36d7
SHA256

191379b874ac177066df5e12db961baa5fd24fe2e7bbbe76973fedcc72d6a9e3
SHA512

9bf51711975220798e9d4e01764e0b6e2dd349ccf34640575c1ccc9e0a6f35057e765142dc385877da50d8171c17c8475c5c9cc0de3479cf1962d17acdc445ee
SSDEEP

3072:IDaEa+hRM8au82vat2cPlZuVkezMcNGBQ/Jgo9kS:Ma+hRM8au1I2cPlQuezFGwkS

Score

8^/10

Blocklisted process makes network request 4 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ormsgse.axz	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2744	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2744	3212	rundll32.exe	82
PID 3212 wrote to memory of 2744	3212	rundll32.exe	82
PID 3212 wrote to memory of 2744	3212	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cd52c39aa5eb62d286ed4e31e498ca0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cd52c39aa5eb62d286ed4e31e498ca0_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  PID:2744