f76ce3b5b5e61664336fcb44a49c5152f8a60b9433f23b2e93a26bab71559678

Analysis

max time kernel
157s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 18:24

Target

fd5b27db04e74166d3ace2d8879dbdc5_JaffaCakes118.dll
Size

11KB
MD5

fd5b27db04e74166d3ace2d8879dbdc5
SHA1

021b8c0fec5389c471a7708170ea21d57c4d0afc
SHA256

f76ce3b5b5e61664336fcb44a49c5152f8a60b9433f23b2e93a26bab71559678
SHA512

af744c85bb07d773d7e5c675293bdced77c4964123403ef22939c3a21dafe9e5afde337994689d4c354c5ed0a52fc5db53f33ee285dc77f49257a8313f533ba9
SSDEEP

192:YezlyR5VhjYBIXYYTPnRWw9c7SdhlL/l0qSFnUQ1iHk8z44NUx4S3OOk+v5HkLkW:YezATzYBgTTPnMOc2Tl7l0qnxHkv4NlR

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2836	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2836	5044	rundll32.exe	91
PID 5044 wrote to memory of 2836	5044	rundll32.exe	91
PID 5044 wrote to memory of 2836	5044	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd5b27db04e74166d3ace2d8879dbdc5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd5b27db04e74166d3ace2d8879dbdc5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:880

memory/2836-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download