a8df1bdbfed7fcb1420ebdacce0d5848bd97fd308b2ef5bf00ce01a01c1ee19d

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 17:55

Target

08697616a46a37fde86719d2af115ab5_JaffaCakes118.dll
Size

203KB
MD5

08697616a46a37fde86719d2af115ab5
SHA1

895a7058db26fae2874d563af39b51662148a80f
SHA256

a8df1bdbfed7fcb1420ebdacce0d5848bd97fd308b2ef5bf00ce01a01c1ee19d
SHA512

20322726ca63e999f59750dba6561adb8cd96923b69a55be2c758503127726204a0b347d5f20efae963135aa1a589145476c4b476f76145b9e1d54f26c2ccf2d
SSDEEP

3072:axgA0StPG899Gj4WKkIItcwu9s96Zb7imKe9ohwQ4ZuMzZHReEzp0JR1:axj7GYCfz6G96hN6aZuM5ReipY

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\zuoyu16.ini	rundll32.exe
File opened for modification	C:\Windows\win.ini	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 3348	232	rundll32.exe	81
PID 232 wrote to memory of 3348	232	rundll32.exe	81
PID 232 wrote to memory of 3348	232	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08697616a46a37fde86719d2af115ab5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08697616a46a37fde86719d2af115ab5_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3348

C:\Windows\zuoyu16.ini

Filesize
40B

MD5
2f252db48a212a83dc16ee89c0bd95c3

SHA1
a4dfdf31b25da5816abfc95f3187cacee791507f

SHA256
501698dc94fa70b9ba9368170b2ebcdcc1263d7b5ebe639b4556cadc3516f460

SHA512
0ebec3d15da6866e2987af09cef76ae880a80509b4b5c778fa6ffc054036e8cbb883151c76c8dfb90960a72a67c0dc3da82ee71c22888be2a9b981ef4048fd25

Download Submit