a806a92cb4fba20eab0e436a41d07140f449f91e40fba58b864eae5131269700

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 01:08

Target

fb9536d04e514ac302efc56bcb776f10_JaffaCakes118.dll
Size

34KB
MD5

fb9536d04e514ac302efc56bcb776f10
SHA1

71a69db83ab715a183258ae09210b91d3206b724
SHA256

a806a92cb4fba20eab0e436a41d07140f449f91e40fba58b864eae5131269700
SHA512

fe6e51ccafa1b109421942adbdbc8bb9bc2a058d856617ecd2d62763fb162e376b96b8401f750204d07788763d6732307dfbbf1218900be975a8c7c189aebb5f
SSDEEP

384:tGlxsyR6H2TcTSAw0eeXHXoMKr345Pz7F2mlM3+gGZsxx:tGlxfULTvRDXHS345PcB3+RZ

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jkjkll.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\jkjkll.dll	rundll32.exe
File created	C:\Windows\SysWOW64\ghjyer.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ghjyer.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2744	2508	rundll32.exe	28
PID 2508 wrote to memory of 2744	2508	rundll32.exe	28
PID 2508 wrote to memory of 2744	2508	rundll32.exe	28
PID 2508 wrote to memory of 2744	2508	rundll32.exe	28
PID 2508 wrote to memory of 2744	2508	rundll32.exe	28
PID 2508 wrote to memory of 2744	2508	rundll32.exe	28
PID 2508 wrote to memory of 2744	2508	rundll32.exe	28
PID 2744 wrote to memory of 1200	2744	rundll32.exe	21
PID 2744 wrote to memory of 1200	2744	rundll32.exe	21
PID 2744 wrote to memory of 460	2744	rundll32.exe	17
PID 2744 wrote to memory of 460	2744	rundll32.exe	17

memory/1200-2-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download