ad90d73290930e9630b5633232f9e53be9286c08cb3ee7130637adbf1cab6501

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 01:06

Target

fb93ca0b66dc4b6b8ba8890da9e7952b_JaffaCakes118.dll
Size

11KB
MD5

fb93ca0b66dc4b6b8ba8890da9e7952b
SHA1

89aa72ef4153f4686c7a63661dd84735d0d4e7fd
SHA256

ad90d73290930e9630b5633232f9e53be9286c08cb3ee7130637adbf1cab6501
SHA512

3b2b15be1127c1a9f033adf110fd45ee10feabdd98508a25cb7221661676f9bcd6f74b2b76c9e57a33fd587980f7f5fc698f4386001e1ad9b3e7cca264e89fdf
SSDEEP

192:Fv0NYyHjElOUfGMEqGt8gBXAbmgv/O1oWd6oeJGYb06j9vcQzmhPg1kgUw9p:Fv0OQEOvsUJE/LWdFijBcGCK

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2752	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2752	2852	rundll32.exe	28
PID 2852 wrote to memory of 2752	2852	rundll32.exe	28
PID 2852 wrote to memory of 2752	2852	rundll32.exe	28
PID 2852 wrote to memory of 2752	2852	rundll32.exe	28
PID 2852 wrote to memory of 2752	2852	rundll32.exe	28
PID 2852 wrote to memory of 2752	2852	rundll32.exe	28
PID 2852 wrote to memory of 2752	2852	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb93ca0b66dc4b6b8ba8890da9e7952b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb93ca0b66dc4b6b8ba8890da9e7952b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2752

memory/2752-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download