31d40d3b93d89023110f3eb36df650854267fcbaf5e01960db5bcf073c81e35c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 10:33

Target

4150b99e75800e41636ce2d45ed810f5_JaffaCakes118.dll
Size

15KB
MD5

4150b99e75800e41636ce2d45ed810f5
SHA1

5ec38718bb528836669510830d29f0deb7ad8646
SHA256

31d40d3b93d89023110f3eb36df650854267fcbaf5e01960db5bcf073c81e35c
SHA512

f18cb31acdcc1a6d80779b04daa6169c22494e6a4802c81af5b46a9893c688c5542c118799240751035f3126ea6613efd24f6913bd5b772bd3812d83625b8316
SSDEEP

192:uefsYfYfR9u0aMKsOiFiT4bdzaXEASnXrcg4Pv7NICB4OCg/JgWQlgWKG1f2o4xZ:uevgJq8JReXEAu7cLxHSOZRMnJHe/R

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HookHelp.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4150b99e75800e41636ce2d45ed810f5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4150b99e75800e41636ce2d45ed810f5_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1048

memory/1048-4-0x0000000025015000-0x0000000025016000-memory.dmp

Filesize
4KB

Download
memory/1048-3-0x0000000025000000-0x000000002501D000-memory.dmp

Filesize
116KB

Download