Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
24/06/2024, 18:27
General
-
Target
0a21034c5cd194afa7c80a750793e7f2_JaffaCakes118.dll
-
Size
10KB
-
MD5
0a21034c5cd194afa7c80a750793e7f2
-
SHA1
2464c96669598b25daba6415bf2419abda82a5c4
-
SHA256
a755012407f6c5f4ade6f404a6bf7f47accd7cfa77f0949c68a329e60fd321fb
-
SHA512
7c893cbbeb808965cf3ac5f8e93717cdc69283972f9b6f4322321b9c867592854f5476f175b73adbdd59fcf99c2d676c547f5e51178337befcbe11703cceda79
-
SSDEEP
96:RsjdJwwq5iOCj7ni+Zny0dhp21/8NNgS+BJ/bdd61u4XOOD:RsZiwqTCj7nNdyGUJ8N2V/bdd4OOD
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a21034c5cd194afa7c80a750793e7f2_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a21034c5cd194afa7c80a750793e7f2_JaffaCakes118.dll,#13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-