ad90d73290930e9630b5633232f9e53be9286c08cb3ee7130637adbf1cab6501

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 01:06

Target

fb93ca0b66dc4b6b8ba8890da9e7952b_JaffaCakes118.dll
Size

11KB
MD5

fb93ca0b66dc4b6b8ba8890da9e7952b
SHA1

89aa72ef4153f4686c7a63661dd84735d0d4e7fd
SHA256

ad90d73290930e9630b5633232f9e53be9286c08cb3ee7130637adbf1cab6501
SHA512

3b2b15be1127c1a9f033adf110fd45ee10feabdd98508a25cb7221661676f9bcd6f74b2b76c9e57a33fd587980f7f5fc698f4386001e1ad9b3e7cca264e89fdf
SSDEEP

192:Fv0NYyHjElOUfGMEqGt8gBXAbmgv/O1oWd6oeJGYb06j9vcQzmhPg1kgUw9p:Fv0OQEOvsUJE/LWdFijBcGCK

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
432	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
432	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 432	4924	rundll32.exe	82
PID 4924 wrote to memory of 432	4924	rundll32.exe	82
PID 4924 wrote to memory of 432	4924	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb93ca0b66dc4b6b8ba8890da9e7952b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb93ca0b66dc4b6b8ba8890da9e7952b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:432

memory/432-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download