c4c0f1e2d9168b560f0d040e62a4a0b96942ac897eba31858bc88e6e68e5312d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 06:25

Target

24ef6c7ac88e8b4ef877280c67a67880_JaffaCakes118.dll
Size

9KB
MD5

24ef6c7ac88e8b4ef877280c67a67880
SHA1

2ab50b396525d72c5bfbdab4f84ed20af98f37c0
SHA256

c4c0f1e2d9168b560f0d040e62a4a0b96942ac897eba31858bc88e6e68e5312d
SHA512

51f22abe6117b8559538e7f722e32a5f99ca6e3f6acffc3f97aef5571e2be07884e67df21c4fc6be81c839b17b7821bc416e11ac0f8fda09d9e4ea25b3baa0c0
SSDEEP

96:Ptod1wyCx6Akvh8ZN2SLaRexGb0Ad49b9oS+BfOb3jrQ9w2h:ekdMh8GSLaRXb9nTObzrGh

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	rundll32.exe
1376	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1376	1720	rundll32.exe	28
PID 1720 wrote to memory of 1376	1720	rundll32.exe	28
PID 1720 wrote to memory of 1376	1720	rundll32.exe	28
PID 1720 wrote to memory of 1376	1720	rundll32.exe	28
PID 1720 wrote to memory of 1376	1720	rundll32.exe	28
PID 1720 wrote to memory of 1376	1720	rundll32.exe	28
PID 1720 wrote to memory of 1376	1720	rundll32.exe	28
PID 1376 wrote to memory of 1196	1376	rundll32.exe	21

memory/1196-0-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download