1912e4332bf18d47c98f2cf6931a1dc160fa6269d27670529390aaee5a8c7306

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 07:26

Target

ea8cf7f981d7f05bd6d61c5cf7a4c751_JaffaCakes118.dll
Size

12KB
MD5

ea8cf7f981d7f05bd6d61c5cf7a4c751
SHA1

3eadf3f1e864314f44d63eeee4ad260240714b81
SHA256

1912e4332bf18d47c98f2cf6931a1dc160fa6269d27670529390aaee5a8c7306
SHA512

47cca631d6c8300ba5d5f30b3bbb8c7b813046b4885f9e21d7550c6701c7108ad3b1bae83a361922728c67afe940461b5d7430f8cdaa034bf72279f199f42021
SSDEEP

192:Wh/55vkM7hRE3ha2Cd2n0tfzpfc9H8g2+cLCZieBxTgBEC7j6XQaID3vHOpkgUwx:sR5ZNKRac0t9frg2++jeBxchSQaIKmY

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
676	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3184	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3184	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3184	4700	rundll32.exe	93
PID 4700 wrote to memory of 3184	4700	rundll32.exe	93
PID 4700 wrote to memory of 3184	4700	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea8cf7f981d7f05bd6d61c5cf7a4c751_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea8cf7f981d7f05bd6d61c5cf7a4c751_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:2184

memory/3184-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download