9e5da4b1f71dcb254a0264ad6c25286132ddac811edbc6be89dc86f9b6d871d4

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:26

Target

0eeba3acf3ab46190c84be4cb21652b7_JaffaCakes118.dll
Size

13KB
MD5

0eeba3acf3ab46190c84be4cb21652b7
SHA1

5eefb61bb10ccb44e9f9c6349565bdb70374be4c
SHA256

9e5da4b1f71dcb254a0264ad6c25286132ddac811edbc6be89dc86f9b6d871d4
SHA512

a9b05e2bb09a7d516a21df50a25bd6ee98fb255a77d855f92e7e606b82b6c99e5ccc6470b0739fa645d203926f24c260e136d8163ef502955714d543bc140e6b
SSDEEP

192:BwK/Fy3d518xMFKq13KxNEzAcNZqfMmAhlA3GYsWSC7iDs29mdaZtDr1h2LGr80t:Ba5qxhq13KxNu9X9dD3mdaZtDr1hmo6W

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2676-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2676	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2676	3008	rundll32.exe	81
PID 3008 wrote to memory of 2676	3008	rundll32.exe	81
PID 3008 wrote to memory of 2676	3008	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0eeba3acf3ab46190c84be4cb21652b7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0eeba3acf3ab46190c84be4cb21652b7_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2676

memory/2676-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download