d571f1c28e36f2ccc101f8fe0868e569bc61fafd134799997f9d69a15dc66f07

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 19:47

Target

3621426a9f7088bbc878f01df20458f8_JaffaCakes118.dll
Size

107KB
MD5

3621426a9f7088bbc878f01df20458f8
SHA1

19913b7de0a6a9dfd85f9e9d7b4d428297f24baa
SHA256

d571f1c28e36f2ccc101f8fe0868e569bc61fafd134799997f9d69a15dc66f07
SHA512

d02febfb24c53388282113c17aa40827600d54d6307e34e7f29df3414832e6121ef91c42d16ab8fdf2b70079c053035bd0ea8ea040b6a1303f3639b29c0debf8
SSDEEP

3072:2I6nJHNlob8Nv61PkHS1HubRyEqZh1OEcc:gZ/ob8Nv61P4RyEWh1OEcc

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1720	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1720	2088	rundll32.exe	30
PID 2088 wrote to memory of 1720	2088	rundll32.exe	30
PID 2088 wrote to memory of 1720	2088	rundll32.exe	30
PID 2088 wrote to memory of 1720	2088	rundll32.exe	30
PID 2088 wrote to memory of 1720	2088	rundll32.exe	30
PID 2088 wrote to memory of 1720	2088	rundll32.exe	30
PID 2088 wrote to memory of 1720	2088	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3621426a9f7088bbc878f01df20458f8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3621426a9f7088bbc878f01df20458f8_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1720

memory/1720-1-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/1720-3-0x000000001001F000-0x0000000010020000-memory.dmp

Filesize
4KB

Download
memory/1720-2-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/1720-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/1720-4-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download