a73184de106fb0a11ea85acde901c3273872dae9709b891ca1585f04d72a2211

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 12:23

Target

2c549fb80149010480d48c1a819a5834_JaffaCakes118.dll
Size

21KB
MD5

2c549fb80149010480d48c1a819a5834
SHA1

c6d0bc6622305c4797646a563e12bd67a7f45b14
SHA256

a73184de106fb0a11ea85acde901c3273872dae9709b891ca1585f04d72a2211
SHA512

c6cc053a07884d85803dc1b4ef9f16f16ab1468eab2e961e1136ce959c228bd355aef4a4a38c5a5154d84a49722f8941dacc383fd8c2928c4cca55ffc8b22e41
SSDEEP

384:/t5+MarWmcKBFyd0ofjD6uvv4kuB+n7s6jV:FRmdFydDfjrnZsI7s6jV

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2988	2784	rundll32.exe	82
PID 2784 wrote to memory of 2988	2784	rundll32.exe	82
PID 2784 wrote to memory of 2988	2784	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c549fb80149010480d48c1a819a5834_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c549fb80149010480d48c1a819a5834_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2988

memory/2988-0-0x0000000020000000-0x000000002000C000-memory.dmp

Filesize
48KB

Download