Analysis
-
max time kernel
133s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
04-07-2024 06:25
General
-
Target
24ef6c7ac88e8b4ef877280c67a67880_JaffaCakes118.dll
-
Size
9KB
-
MD5
24ef6c7ac88e8b4ef877280c67a67880
-
SHA1
2ab50b396525d72c5bfbdab4f84ed20af98f37c0
-
SHA256
c4c0f1e2d9168b560f0d040e62a4a0b96942ac897eba31858bc88e6e68e5312d
-
SHA512
51f22abe6117b8559538e7f722e32a5f99ca6e3f6acffc3f97aef5571e2be07884e67df21c4fc6be81c839b17b7821bc416e11ac0f8fda09d9e4ea25b3baa0c0
-
SSDEEP
96:Ptod1wyCx6Akvh8ZN2SLaRexGb0Ad49b9oS+BfOb3jrQ9w2h:ekdMh8GSLaRXb9nTObzrGh
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24ef6c7ac88e8b4ef877280c67a67880_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\24ef6c7ac88e8b4ef877280c67a67880_JaffaCakes118.dll,#13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-