d334ed55338d28c436b8d37d61e72e1fece32b87da8ed4ef0ff551edf79cdb5f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/06/2024, 23:31

Target

044598c9b40b110ae172fa9ff542d184_JaffaCakes118.dll
Size

212KB
MD5

044598c9b40b110ae172fa9ff542d184
SHA1

97c4a1cf9a4e06d67d1ff20a0757a71c117329aa
SHA256

d334ed55338d28c436b8d37d61e72e1fece32b87da8ed4ef0ff551edf79cdb5f
SHA512

e52bfdea070137827e6e082cedbd0f211d78cf7d681ed27bdb2f07f6c47856997c9137a1758e22ca8fe4746f109f326353c12d1e1b37718159feae5d564dcace
SSDEEP

6144:y21GNmfXgeEnsv0jSEP5GSd2JgZAHuAEPj:5GNmfQeE/SeGSdygmTEPj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2988	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2988	rundll32.exe
2988	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2988	2928	rundll32.exe	28
PID 2928 wrote to memory of 2988	2928	rundll32.exe	28
PID 2928 wrote to memory of 2988	2928	rundll32.exe	28
PID 2928 wrote to memory of 2988	2928	rundll32.exe	28
PID 2928 wrote to memory of 2988	2928	rundll32.exe	28
PID 2928 wrote to memory of 2988	2928	rundll32.exe	28
PID 2928 wrote to memory of 2988	2928	rundll32.exe	28
PID 2988 wrote to memory of 2188	2988	rundll32.exe	29
PID 2988 wrote to memory of 2188	2988	rundll32.exe	29
PID 2988 wrote to memory of 2188	2988	rundll32.exe	29
PID 2988 wrote to memory of 2188	2988	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\044598c9b40b110ae172fa9ff542d184_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\044598c9b40b110ae172fa9ff542d184_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 312
    3⤵
    - Program crash
    PID:2188