f9cc76fc2459d23a375595a059fcb1c1bef710e9ec758afb4e0ce672fdce0a5b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 11:14

Target

0ddbc1732d80e636414e5aef7a9d1668_JaffaCakes118.dll
Size

306KB
MD5

0ddbc1732d80e636414e5aef7a9d1668
SHA1

99bda2926fb16f8e3c2660f246bb590aa5d467a5
SHA256

f9cc76fc2459d23a375595a059fcb1c1bef710e9ec758afb4e0ce672fdce0a5b
SHA512

f5b01e46544898fc4b05584a526d80af54e01218a06a02d057b320ba82d102cc4299f26aa342c349e1ecfd812ded88f0539632712cf7723996ffb2a215c61653
SSDEEP

6144:isEmwU8iD14VHlzUByOocnOBUZ1EwzN8jh1TBueAt7:pEwPhrBB/1Ewzujh1TcFB

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	rundll32.exe
2832	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2832	1732	rundll32.exe	28
PID 1732 wrote to memory of 2832	1732	rundll32.exe	28
PID 1732 wrote to memory of 2832	1732	rundll32.exe	28
PID 1732 wrote to memory of 2832	1732	rundll32.exe	28
PID 1732 wrote to memory of 2832	1732	rundll32.exe	28
PID 1732 wrote to memory of 2832	1732	rundll32.exe	28
PID 1732 wrote to memory of 2832	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ddbc1732d80e636414e5aef7a9d1668_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ddbc1732d80e636414e5aef7a9d1668_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832