58b991cb5e88fe34b54232acee3e7c78b3c420549b09f8c4c4040f46e6a8f203

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 15:39

Target

168e2a9f007581645b065b99f38c152a_JaffaCakes118.dll
Size

102KB
MD5

168e2a9f007581645b065b99f38c152a
SHA1

c5c7b5c8d50ac9378c2b166d0cdb79469fc5cb6f
SHA256

58b991cb5e88fe34b54232acee3e7c78b3c420549b09f8c4c4040f46e6a8f203
SHA512

55e1722de0c5382f0029ce16301f11c03255371af0781a55b9d8ee56e395d540c29b1c7559151e573f2dbc585377a6e4c88cce2e78f96a0627fadeac041afa95
SSDEEP

1536:FGq/moJQGnAYYIsSSsxBRHYBDLy2fXk+b1itytbkzUaMx8Q8sk7dP9PP2x:BJMnS9rpp2fXrBitysNh3dP9P+x

Score

1^/10

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1732	rundll32.exe
Token: SeSecurityPrivilege	1732	rundll32.exe
Token: SeTakeOwnershipPrivilege	1732	rundll32.exe
Token: SeLoadDriverPrivilege	1732	rundll32.exe
Token: SeSystemProfilePrivilege	1732	rundll32.exe
Token: SeSystemtimePrivilege	1732	rundll32.exe
Token: SeProfSingleProcessPrivilege	1732	rundll32.exe
Token: SeIncBasePriorityPrivilege	1732	rundll32.exe
Token: SeCreatePagefilePrivilege	1732	rundll32.exe
Token: SeShutdownPrivilege	1732	rundll32.exe
Token: SeDebugPrivilege	1732	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1732	rundll32.exe
Token: SeRemoteShutdownPrivilege	1732	rundll32.exe
Token: SeUndockPrivilege	1732	rundll32.exe
Token: SeManageVolumePrivilege	1732	rundll32.exe
Token: 33	1732	rundll32.exe
Token: 34	1732	rundll32.exe
Token: 35	1732	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\168e2a9f007581645b065b99f38c152a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\168e2a9f007581645b065b99f38c152a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1732