51b7d5c0834552b70fa064fb224058691bf51762656d0ffa70abb5d281c0e9f5

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 16:54

Target

07f62b8f81cd5dea5fd02b2c902f1ec3_JaffaCakes118.dll
Size

46KB
MD5

07f62b8f81cd5dea5fd02b2c902f1ec3
SHA1

bf557cca6c9e73037baec4e3092d059b8194ef0d
SHA256

51b7d5c0834552b70fa064fb224058691bf51762656d0ffa70abb5d281c0e9f5
SHA512

a9daf77cca5b02e9c2d38522c3c9cf04ef020e339356411a6836073b11e3c5ca7a1f5aef95fc057820ffc20d29caa9d55ee5da7a44a20e7d2be6c36053559add
SSDEEP

768:ifdDTZNXD8+XavUqcrfXdA8cU0ewFKhWRtympPHMptJH+UZHUNYif+acBIc:MdDTbAUlXdANdewFK+QEMBJZ0NYqc

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ethyg.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ethyg.dll	rundll32.exe
File created	C:\Windows\SysWOW64\ghrst.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ghrst.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1164	1948	rundll32.exe	28
PID 1948 wrote to memory of 1164	1948	rundll32.exe	28
PID 1948 wrote to memory of 1164	1948	rundll32.exe	28
PID 1948 wrote to memory of 1164	1948	rundll32.exe	28
PID 1948 wrote to memory of 1164	1948	rundll32.exe	28
PID 1948 wrote to memory of 1164	1948	rundll32.exe	28
PID 1948 wrote to memory of 1164	1948	rundll32.exe	28
PID 1164 wrote to memory of 1172	1164	rundll32.exe	21
PID 1164 wrote to memory of 1172	1164	rundll32.exe	21
PID 1164 wrote to memory of 1072	1164	rundll32.exe	17
PID 1164 wrote to memory of 1072	1164	rundll32.exe	17

memory/1172-2-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download