3353036885967dac7b842bf028c02125452ecf92d743e3ddcaea3e38cb327619

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 15:58

Target

3e062a360221d0bfe416958bbcf9a4cf_JaffaCakes118.dll
Size

36KB
MD5

3e062a360221d0bfe416958bbcf9a4cf
SHA1

2220e4207982b3bbdb92bb10d35f13babfbcb373
SHA256

3353036885967dac7b842bf028c02125452ecf92d743e3ddcaea3e38cb327619
SHA512

6995cbe0c29d1ab210b3d06dd3aa0e46bc38ef156e47520cd3202117f4db5397655d4af77e1159d87df60d6585e4ecbe48301f40b6b2eea06bfc24778de55e11
SSDEEP

768:n+zjdqPTEIdDNBivDTGrfS14CyMajVsZkEM:+vA7EU5qsfS5ajV2LM

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dgd4bs.exe	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2528	2732	rundll32.exe	29
PID 2732 wrote to memory of 2528	2732	rundll32.exe	29
PID 2732 wrote to memory of 2528	2732	rundll32.exe	29
PID 2732 wrote to memory of 2528	2732	rundll32.exe	29
PID 2732 wrote to memory of 2528	2732	rundll32.exe	29
PID 2732 wrote to memory of 2528	2732	rundll32.exe	29
PID 2732 wrote to memory of 2528	2732	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e062a360221d0bfe416958bbcf9a4cf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e062a360221d0bfe416958bbcf9a4cf_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2528

memory/2528-2-0x0000000010014000-0x0000000010015000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2528-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download