92a5a48d9cace39c14f0b2452e39fb4c842c9fdcb70c1544cc58b33e3ef81c9d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 20:16

Target

1c5aee5b84c7b69563262667e290320f_JaffaCakes118.dll
Size

39KB
MD5

1c5aee5b84c7b69563262667e290320f
SHA1

ff2ad7345d048946ed8ab03cb3320c88c9e6da2f
SHA256

92a5a48d9cace39c14f0b2452e39fb4c842c9fdcb70c1544cc58b33e3ef81c9d
SHA512

94e0c8516f15fff9b7d4d03a1db978b93b813d94aa13f9d37e11aaeed050aa69c45b60a01b5d5bb1404a5abef39c9eb16b87ff30dd91bbc38eb723e5c6441bc0
SSDEEP

768:KxjUZqqAEJKbZ1SGACqpQryPE6SC+RZO7fjkisOa:KxgqqAEJKbr9AXpQVDhZcfS

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File created	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 1752 wrote to memory of 2324	1752	rundll32.exe	28
PID 2324 wrote to memory of 1212	2324	rundll32.exe	21
PID 2324 wrote to memory of 1212	2324	rundll32.exe	21
PID 2324 wrote to memory of 924	2324	rundll32.exe	17
PID 2324 wrote to memory of 924	2324	rundll32.exe	17

memory/1212-2-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download