e349ab8fa085ebeadd191c2247810e9263f7b1ad44dcccbd85ada619947f7d89

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 02:01

Target

47c026adb6f9cdc5b45da9090483437f_JaffaCakes118.dll
Size

20KB
MD5

47c026adb6f9cdc5b45da9090483437f
SHA1

5cd1a4d29374ae338753ae4cd6bba82aa81c8c46
SHA256

e349ab8fa085ebeadd191c2247810e9263f7b1ad44dcccbd85ada619947f7d89
SHA512

037fa3f889b3993f1f8a9faca015a2cb5b7ae9b939887e819d6ad702e53dfde7b1b20dfe4ae9222c067af3443823b31eb045cdfde7d9a0fc1d6385348a5f4e6c
SSDEEP

384:euKsAj9xhyXM0J4eaLuui5tPhQ/JMyPYf/vJfFeZQf/vQI:euuxhMJJ9n5tJQ/JMdfnJwS

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mseion.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2180	2120	rundll32.exe	30
PID 2120 wrote to memory of 2180	2120	rundll32.exe	30
PID 2120 wrote to memory of 2180	2120	rundll32.exe	30
PID 2120 wrote to memory of 2180	2120	rundll32.exe	30
PID 2120 wrote to memory of 2180	2120	rundll32.exe	30
PID 2120 wrote to memory of 2180	2120	rundll32.exe	30
PID 2120 wrote to memory of 2180	2120	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c026adb6f9cdc5b45da9090483437f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c026adb6f9cdc5b45da9090483437f_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2180

memory/2180-0-0x0000000025000000-0x0000000025023000-memory.dmp

Filesize
140KB

Download
memory/2180-4-0x000000002501B000-0x000000002501C000-memory.dmp

Filesize
4KB

Download
memory/2180-3-0x0000000025000000-0x0000000025023000-memory.dmp

Filesize
140KB

Download
memory/2180-2-0x0000000025000000-0x0000000025023000-memory.dmp

Filesize
140KB

Download
memory/2180-1-0x0000000025000000-0x0000000025023000-memory.dmp

Filesize
140KB

Download