58b991cb5e88fe34b54232acee3e7c78b3c420549b09f8c4c4040f46e6a8f203

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 15:39

Target

168e2a9f007581645b065b99f38c152a_JaffaCakes118.dll
Size

102KB
MD5

168e2a9f007581645b065b99f38c152a
SHA1

c5c7b5c8d50ac9378c2b166d0cdb79469fc5cb6f
SHA256

58b991cb5e88fe34b54232acee3e7c78b3c420549b09f8c4c4040f46e6a8f203
SHA512

55e1722de0c5382f0029ce16301f11c03255371af0781a55b9d8ee56e395d540c29b1c7559151e573f2dbc585377a6e4c88cce2e78f96a0627fadeac041afa95
SSDEEP

1536:FGq/moJQGnAYYIsSSsxBRHYBDLy2fXk+b1itytbkzUaMx8Q8sk7dP9PP2x:BJMnS9rpp2fXrBitysNh3dP9P+x

Score

1^/10

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	540	rundll32.exe
Token: SeSecurityPrivilege	540	rundll32.exe
Token: SeTakeOwnershipPrivilege	540	rundll32.exe
Token: SeLoadDriverPrivilege	540	rundll32.exe
Token: SeSystemProfilePrivilege	540	rundll32.exe
Token: SeSystemtimePrivilege	540	rundll32.exe
Token: SeProfSingleProcessPrivilege	540	rundll32.exe
Token: SeIncBasePriorityPrivilege	540	rundll32.exe
Token: SeCreatePagefilePrivilege	540	rundll32.exe
Token: SeShutdownPrivilege	540	rundll32.exe
Token: SeDebugPrivilege	540	rundll32.exe
Token: SeSystemEnvironmentPrivilege	540	rundll32.exe
Token: SeRemoteShutdownPrivilege	540	rundll32.exe
Token: SeUndockPrivilege	540	rundll32.exe
Token: SeManageVolumePrivilege	540	rundll32.exe
Token: 33	540	rundll32.exe
Token: 34	540	rundll32.exe
Token: 35	540	rundll32.exe
Token: 36	540	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 540	4088	rundll32.exe	80
PID 4088 wrote to memory of 540	4088	rundll32.exe	80
PID 4088 wrote to memory of 540	4088	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\168e2a9f007581645b065b99f38c152a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\168e2a9f007581645b065b99f38c152a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:540