c15056bb57f21d56a48033b129a055224b0262fa0ed768a6d2ce0d99ef165dec

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 21:07

Target

2dccc150cb5a886af878cdd2159ce0a9_JaffaCakes118.dll
Size

32KB
MD5

2dccc150cb5a886af878cdd2159ce0a9
SHA1

2ae71ca8b85a49040ebcaccb7dedc97a325fcc52
SHA256

c15056bb57f21d56a48033b129a055224b0262fa0ed768a6d2ce0d99ef165dec
SHA512

d0589ecdd3284be82f147ace1cc8f7ff92f69e3d3d8639dd0a12f8dfc21a2880f43029571390921215d4fd98846000449b5a27363328981f8b0d091df112d215
SSDEEP

384:+WEzaGuDvQ6KsGjUaKQpU5ffFiPIgFF/pb+gGZucn4v:0arjQ+BaKQpU5fNiPPFBb+RZa

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tuker.dll	rundll32.exe
File created	C:\Windows\SysWOW64\ujkwet.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ujkwet.dll	rundll32.exe
File created	C:\Windows\SysWOW64\tuker.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 3068	2384	rundll32.exe	30
PID 2384 wrote to memory of 3068	2384	rundll32.exe	30
PID 2384 wrote to memory of 3068	2384	rundll32.exe	30
PID 2384 wrote to memory of 3068	2384	rundll32.exe	30
PID 2384 wrote to memory of 3068	2384	rundll32.exe	30
PID 2384 wrote to memory of 3068	2384	rundll32.exe	30
PID 2384 wrote to memory of 3068	2384	rundll32.exe	30
PID 3068 wrote to memory of 1200	3068	rundll32.exe	21
PID 3068 wrote to memory of 1200	3068	rundll32.exe	21
PID 3068 wrote to memory of 352	3068	rundll32.exe	17
PID 3068 wrote to memory of 352	3068	rundll32.exe	17

memory/1200-2-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download