91895e8df0069c8c8513d8081cff4e77e64cdb291fba36676784c618724bd953

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 05:22

Target

14d0fcbc669e56f4590c80fa45a0730b_JaffaCakes118.dll
Size

308KB
MD5

14d0fcbc669e56f4590c80fa45a0730b
SHA1

d18809e2d15ceeb1deba17f1a07844e873dfc327
SHA256

91895e8df0069c8c8513d8081cff4e77e64cdb291fba36676784c618724bd953
SHA512

113fa27ba31cee3365aa0b4b5c4e362dcb1c811cc7f6a6d4497e3e7bb1f209251c3b6885f339f9d723f3aa8dbef98e402c97fdf631be40b518287f596a8d8173
SSDEEP

6144:8bVAj2cwkucR1CXVkWtaP6VMGh0HPbQSCwvR60Jnz4Vwajp2TBMuhxAE6:vjrucR1wkSayD0OkrJnz4xjp2T6uoT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	1600	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1600	5036	rundll32.exe	81
PID 5036 wrote to memory of 1600	5036	rundll32.exe	81
PID 5036 wrote to memory of 1600	5036	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14d0fcbc669e56f4590c80fa45a0730b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14d0fcbc669e56f4590c80fa45a0730b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 680
    3⤵
    - Program crash
    PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1600 -ip 1600
1⤵
PID:5084