a1b68d645e986decbf9cae93f6a98a228604ed9ee47911023b0d4935cc28cb94

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 19:27

Target

511b6b02204cf8e96d169a4401d1ab9d_JaffaCakes118.dll
Size

7.0MB
MD5

511b6b02204cf8e96d169a4401d1ab9d
SHA1

97fb9c4a349a674f005f49f89d03cf522b040d6c
SHA256

a1b68d645e986decbf9cae93f6a98a228604ed9ee47911023b0d4935cc28cb94
SHA512

76d0ae80037f6a472e83d8c7b47697a112bb92d9ef5e7d02148c8ffd6882298d1edefceb37a61e796a19b92d643f4bcbb8cf4d100471a2779ff2cfcb0468bdfe
SSDEEP

196608:kbn+nq+DYEY4QuwwV1At902yu+D02yWVI7b:En+57ZTLu60n7b

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2428	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2428	4720	rundll32.exe	84
PID 4720 wrote to memory of 2428	4720	rundll32.exe	84
PID 4720 wrote to memory of 2428	4720	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\511b6b02204cf8e96d169a4401d1ab9d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\511b6b02204cf8e96d169a4401d1ab9d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

memory/2428-0-0x000000007496F000-0x0000000074DDB000-memory.dmp

Filesize
4.4MB

Download
memory/2428-2-0x0000000001620000-0x0000000001621000-memory.dmp

Filesize
4KB

Download
memory/2428-1-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/2428-3-0x0000000074890000-0x00000000754E8000-memory.dmp

Filesize
12.3MB

Download
memory/2428-6-0x0000000074890000-0x00000000754E8000-memory.dmp

Filesize
12.3MB

Download
memory/2428-7-0x000000007496F000-0x0000000074DDB000-memory.dmp

Filesize
4.4MB

Download
memory/2428-8-0x0000000074890000-0x00000000754E8000-memory.dmp

Filesize
12.3MB

Download