1e9619009e4970251461923fca29fbe0891fa47185175dcb5b18c1d6749a1077

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 00:06

Target

2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll
Size

51KB
MD5

2e4fe2331d9f5fa9acb5465b974b8311
SHA1

e2db75ae0c9158c52d843a8add21f2bb5d1b3fe2
SHA256

1e9619009e4970251461923fca29fbe0891fa47185175dcb5b18c1d6749a1077
SHA512

40db2b68ab8206219ce9fc8ee122f2b47087f96f4c924e663a03330eb7163c36d5e1f7c5d36ee5dc0f50d0e58fb3fd86ad2357a64509e3128e3647a060d6b0be
SSDEEP

768:Vq/Wj6Q3HgmbYkJnQ0ErnvZhX1uBSzm9DUDYK18z2/Hvl2Fi2bWn8AaOcI6Hv:YWjD3Hgvkl+xcSzm9sYKZJSWn8AaDIM

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nefeyani.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\samapape	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2416	rundll32.exe
2416	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2416	2724	rundll32.exe	30
PID 2724 wrote to memory of 2416	2724	rundll32.exe	30
PID 2724 wrote to memory of 2416	2724	rundll32.exe	30
PID 2724 wrote to memory of 2416	2724	rundll32.exe	30
PID 2724 wrote to memory of 2416	2724	rundll32.exe	30
PID 2724 wrote to memory of 2416	2724	rundll32.exe	30
PID 2724 wrote to memory of 2416	2724	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2416

memory/2416-3-0x0000000000130000-0x0000000000135000-memory.dmp

Filesize
20KB

Download
memory/2416-2-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2416-1-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2416-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2416-4-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2416-6-0x0000000000130000-0x0000000000135000-memory.dmp

Filesize
20KB

Download
memory/2416-5-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download