dab63e7f6519d5448653de828860e690adf752bcf236b033560fbee75d9b3f8a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 05:30

Target

18f38089ab5c85bfcabebaa90827ac3c_JaffaCakes118.dll
Size

42KB
MD5

18f38089ab5c85bfcabebaa90827ac3c
SHA1

b2c5caa5001cec885e319421939bd9a14079dd42
SHA256

dab63e7f6519d5448653de828860e690adf752bcf236b033560fbee75d9b3f8a
SHA512

c0a32a7d1f84a52b8a631f7ab735753224c53e144e6fe6d3049a685d1de7299f645697ffb845748e326c20d3273a023c0d92fb11d304610e2ea6e30c20b2cc1e
SSDEEP

768:kESx8dHtFSGb9xGZKHIgTLNGAzRumr0iFj5TMjDtCMKX:PSx8dPTXoKnD0iFMhCMKX

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18f38089ab5c85bfcabebaa90827ac3c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18f38089ab5c85bfcabebaa90827ac3c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1632

memory/1632-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download