c31529d17974ea0d6c990d64f142cc6dcef75ce49117d4efa00149b89b171862

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 20:49

Target

0f7ac56d68607de6189b4fdef56557b2_JaffaCakes118.dll
Size

47KB
MD5

0f7ac56d68607de6189b4fdef56557b2
SHA1

ab62f983ddf5f8aeb5028cd61bd2664f066a3370
SHA256

c31529d17974ea0d6c990d64f142cc6dcef75ce49117d4efa00149b89b171862
SHA512

9ebc8209a22f4437672b13665dc315c1dc984aec19b951cb396c2b1f509e2d83360c07c2c589c52d0fa24acd1754e068bd23311d5ef77d272840a1b2e2005c90
SSDEEP

768:HueKulVMUf0Ojm1Jl7S+xfK5V2+Mba3k9SviDww1qu8dJgyzQ+o+zEui:OUVY5T+rsO3cxDww1qudyE+Fz

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	rundll32.exe
Token: SeTakeOwnershipPrivilege	2168	rundll32.exe
Token: SeImpersonatePrivilege	2168	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2168	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2168	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f7ac56d68607de6189b4fdef56557b2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f7ac56d68607de6189b4fdef56557b2_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2168

memory/2168-0-0x0000000000170000-0x0000000000174000-memory.dmp

Filesize
16KB

Download
memory/2168-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download