fa98c6f25052ce6a851148439091efad9b734b89b094b6e60610cc8b216946de

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 07:25

Target

2f7631b1d16ed2673fcd2f625cab4602_JaffaCakes118.dll
Size

152KB
MD5

2f7631b1d16ed2673fcd2f625cab4602
SHA1

ea1ebe80ad7948d36d49e7c81191f00ff7c9417c
SHA256

fa98c6f25052ce6a851148439091efad9b734b89b094b6e60610cc8b216946de
SHA512

6c65d91048b02024ee8a59ef1e4ee3fd59e291d7a812d63b47bb7995498e3a9faaf059b7ff98869160c0afb7037d25cfc51ee7b2ad9b2e939051004e7889c152
SSDEEP

3072:OMcOBW8VgdbgssPtinyOt1I4xdFArBPM1bs:OMcOBW8qAl4yzIOrxM1

Score

1^/10

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C1B9CE-1A6F-4994-B4A4-0E7C99AD4C28}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C1B9CE-1A6F-4994-B4A4-0E7C99AD4C28}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C1B9CE-1A6F-4994-B4A4-0E7C99AD4C28}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2f7631b1d16ed2673fcd2f625cab4602_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C1B9CE-1A6F-4994-B4A4-0E7C99AD4C28}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1640	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1640	2292	rundll32.exe	30
PID 2292 wrote to memory of 1640	2292	rundll32.exe	30
PID 2292 wrote to memory of 1640	2292	rundll32.exe	30
PID 2292 wrote to memory of 1640	2292	rundll32.exe	30
PID 2292 wrote to memory of 1640	2292	rundll32.exe	30
PID 2292 wrote to memory of 1640	2292	rundll32.exe	30
PID 2292 wrote to memory of 1640	2292	rundll32.exe	30
PID 1640 wrote to memory of 1200	1640	rundll32.exe	21

memory/1200-0-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/1640-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download