1e9619009e4970251461923fca29fbe0891fa47185175dcb5b18c1d6749a1077

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 00:06

Target

2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll
Size

51KB
MD5

2e4fe2331d9f5fa9acb5465b974b8311
SHA1

e2db75ae0c9158c52d843a8add21f2bb5d1b3fe2
SHA256

1e9619009e4970251461923fca29fbe0891fa47185175dcb5b18c1d6749a1077
SHA512

40db2b68ab8206219ce9fc8ee122f2b47087f96f4c924e663a03330eb7163c36d5e1f7c5d36ee5dc0f50d0e58fb3fd86ad2357a64509e3128e3647a060d6b0be
SSDEEP

768:Vq/Wj6Q3HgmbYkJnQ0ErnvZhX1uBSzm9DUDYK18z2/Hvl2Fi2bWn8AaOcI6Hv:YWjD3Hgvkl+xcSzm9sYKZJSWn8AaDIM

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gopakibi.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\botejora	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3460	rundll32.exe
3460	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 3460	3876	rundll32.exe	82
PID 3876 wrote to memory of 3460	3876	rundll32.exe	82
PID 3876 wrote to memory of 3460	3876	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3460

memory/3460-1-0x0000000001210000-0x0000000001215000-memory.dmp

Filesize
20KB

Download
memory/3460-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/3460-2-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/3460-3-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/3460-4-0x0000000001210000-0x0000000001215000-memory.dmp

Filesize
20KB

Download