15edbd5f07071a1a43268617c07fefd10417f76af039872fbfaf32f86f6cbe05

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 02:48

Target

43fd8295ae3e13b1ef770019479b6b49_JaffaCakes118.dll
Size

50KB
MD5

43fd8295ae3e13b1ef770019479b6b49
SHA1

b57e29114c2cc0bba7110498bd9e5befdcdf8345
SHA256

15edbd5f07071a1a43268617c07fefd10417f76af039872fbfaf32f86f6cbe05
SHA512

7294dc29d5490e38ff728ec3cff785deacbb86e06399570b8fe40c7cdb327137dd97ee28ab9956a84dd3001c54fead43b6623e14dfa287f11519b2b395771a78
SSDEEP

1536:PhaMzzgc+EOScmM1jpgqJNP4DRCsp9eHo+8C:PXngcOhfgqwxp9eIJC

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nodiroho.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\tikopabu	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1588	rundll32.exe
1588	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1588	2556	rundll32.exe	30
PID 2556 wrote to memory of 1588	2556	rundll32.exe	30
PID 2556 wrote to memory of 1588	2556	rundll32.exe	30
PID 2556 wrote to memory of 1588	2556	rundll32.exe	30
PID 2556 wrote to memory of 1588	2556	rundll32.exe	30
PID 2556 wrote to memory of 1588	2556	rundll32.exe	30
PID 2556 wrote to memory of 1588	2556	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43fd8295ae3e13b1ef770019479b6b49_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43fd8295ae3e13b1ef770019479b6b49_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1588

memory/1588-1-0x0000000000170000-0x0000000000175000-memory.dmp

Filesize
20KB

Download
memory/1588-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1588-2-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download