6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:16

Target
jaffacakes118_6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2.dll
Size 25KB
Sample260925-wwl2vsty8m
SHA256 6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2
MD5 84c7f9a3e287f79dc07e44068b46dfa5
SHA1 5c674c3eef56219577b31be37f8a17b5928bbe87
SHA512 8d8a58a4a298980a824b4f8d27b41c8a36e7949d1964af2b0835afec4ccef081c1ccff785c985716a556a243166439c0e47bc262f693d4eda317c532cc01bda7
SSDEEP 384:6p80a4wl1tu3zJFVPhttXR6j03ozkkEt3oP1YsZm3xdvjXimreU65Fj3:S80a4xXpXR8zk3doP1YsudvjX9I93
TLSH
T19CC2FA832E951CF0DE2C513430E72F76C17D2BB50696A5C7AB13DCA59C6B1A2263E783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SfcDisable = "4294967197"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4788	5032	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 5032	4400	rundll32.exe	89
PID 5032 wrote to memory of 2788	5032	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6fdf824c23b8456aebf309d77a92f099556a0f5fac0e38540038e3b0166afda2.dll,#1
  2⤵
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\sfc.exe
    "C:\Windows\system32\sfc.exe" /REVERT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1236
    3⤵
    - Program crash
    PID:4788