e349ab8fa085ebeadd191c2247810e9263f7b1ad44dcccbd85ada619947f7d89

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 02:01

Target

47c026adb6f9cdc5b45da9090483437f_JaffaCakes118.dll
Size

20KB
MD5

47c026adb6f9cdc5b45da9090483437f
SHA1

5cd1a4d29374ae338753ae4cd6bba82aa81c8c46
SHA256

e349ab8fa085ebeadd191c2247810e9263f7b1ad44dcccbd85ada619947f7d89
SHA512

037fa3f889b3993f1f8a9faca015a2cb5b7ae9b939887e819d6ad702e53dfde7b1b20dfe4ae9222c067af3443823b31eb045cdfde7d9a0fc1d6385348a5f4e6c
SSDEEP

384:euKsAj9xhyXM0J4eaLuui5tPhQ/JMyPYf/vJfFeZQf/vQI:euuxhMJJ9n5tJQ/JMdfnJwS

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mseion.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3360	4552	rundll32.exe	83
PID 4552 wrote to memory of 3360	4552	rundll32.exe	83
PID 4552 wrote to memory of 3360	4552	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c026adb6f9cdc5b45da9090483437f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c026adb6f9cdc5b45da9090483437f_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:3360

memory/3360-0-0x0000000025000000-0x0000000025023000-memory.dmp

Filesize
140KB

Download