08cd242f4536f235311801dcb28810f016276ca57a776ad4d8a5fae9f7874557

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 07:28

Target

5f92177359d2c9e3e388e033d2a3a30d_JaffaCakes118.dll
Size

128KB
MD5

5f92177359d2c9e3e388e033d2a3a30d
SHA1

8e0ffa1606d8e53db3586c3519140f93aed41f60
SHA256

08cd242f4536f235311801dcb28810f016276ca57a776ad4d8a5fae9f7874557
SHA512

42a9daedff96c1e9393e8c601634cd633db5a8bc6547b0a1f432b2aeca68d3143a8bf3fe8ee581898a475cd71d02d71226a0bc6e16c8cf922f2303666c036409
SSDEEP

3072:oUZGLLLWmYGIeGxmMSiYkg6s7ZjJgo2lT:vwLWmYGm4MSM/sSl

Score

8^/10

Blocklisted process makes network request 3 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ormsgse.axz	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1412	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31
PID 2476 wrote to memory of 1412	2476	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f92177359d2c9e3e388e033d2a3a30d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f92177359d2c9e3e388e033d2a3a30d_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  PID:1412