c6298d51a98e4b3689b552b7553b51d17085789d0b826eb09f85e491aa6be8d6

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 23:50

Target

04a2b3b8309c6bed8bd8d194817c47bd_JaffaCakes118.dll
Size

308KB
MD5

04a2b3b8309c6bed8bd8d194817c47bd
SHA1

4717d2ec78a703c82bc12f9ec34b8d7425532485
SHA256

c6298d51a98e4b3689b552b7553b51d17085789d0b826eb09f85e491aa6be8d6
SHA512

a109046d8d2bce80e81146a6f498b184277e9ebe13273454d92692f68b116e5aeaa845c449e78fca291e304a2ce92a586efd224f4b52e139313fdfed1da9bda0
SSDEEP

6144:JKVgEqc1+ucROIULkdqDP6FMG8zUvKjTYp501fcVnrTajppTBHuXUAvu:BE6ucRODkcDyGzIDEcVnrmjppTZujW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	4620	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4620	4584	rundll32.exe	82
PID 4584 wrote to memory of 4620	4584	rundll32.exe	82
PID 4584 wrote to memory of 4620	4584	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04a2b3b8309c6bed8bd8d194817c47bd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04a2b3b8309c6bed8bd8d194817c47bd_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 680
    3⤵
    - Program crash
    PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4620 -ip 4620
1⤵
PID:2824