e74b0a3329d714a9aa6d7cf71fed78e266f7ba2c39de8685b35dfa4f37bc9b1c

Analysis

max time kernel
94s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 09:41

Target

2bdb10e217882f6770df117d66b2a162_JaffaCakes118.dll
Size

21KB
MD5

2bdb10e217882f6770df117d66b2a162
SHA1

4da977c614541d91a63afb1aa6bc92218e99d3dc
SHA256

e74b0a3329d714a9aa6d7cf71fed78e266f7ba2c39de8685b35dfa4f37bc9b1c
SHA512

df93f487fc8525a42d4eedd86fd60f7db9b7ec79bb86151298cf5f48babc42b4d0c4a972aabd2809fdd0bf613f9ae3e9a438ac3321adfff09f44723d3539daa9
SSDEEP

192:tX+RsB7hylRGL4lLqopCM6CF7YnKq4G56Jsjx0rtNtCZPRTdO+ICCfh6zRI0jK6p:JAsPEKSZQNqsOtvUjFICC5mb1rq3xAZ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 5096	1636	rundll32.exe	82
PID 1636 wrote to memory of 5096	1636	rundll32.exe	82
PID 1636 wrote to memory of 5096	1636	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bdb10e217882f6770df117d66b2a162_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bdb10e217882f6770df117d66b2a162_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5096

memory/5096-0-0x0000000020000000-0x000000002002C000-memory.dmp

Filesize
176KB

Download