c15056bb57f21d56a48033b129a055224b0262fa0ed768a6d2ce0d99ef165dec

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 21:07

Target

2dccc150cb5a886af878cdd2159ce0a9_JaffaCakes118.dll
Size

32KB
MD5

2dccc150cb5a886af878cdd2159ce0a9
SHA1

2ae71ca8b85a49040ebcaccb7dedc97a325fcc52
SHA256

c15056bb57f21d56a48033b129a055224b0262fa0ed768a6d2ce0d99ef165dec
SHA512

d0589ecdd3284be82f147ace1cc8f7ff92f69e3d3d8639dd0a12f8dfc21a2880f43029571390921215d4fd98846000449b5a27363328981f8b0d091df112d215
SSDEEP

384:+WEzaGuDvQ6KsGjUaKQpU5ffFiPIgFF/pb+gGZucn4v:0arjQ+BaKQpU5fNiPPFBb+RZa

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tuker.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\tuker.dll	rundll32.exe
File created	C:\Windows\SysWOW64\ujkwet.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ujkwet.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4840	4228	rundll32.exe	82
PID 4228 wrote to memory of 4840	4228	rundll32.exe	82
PID 4228 wrote to memory of 4840	4228	rundll32.exe	82
PID 4840 wrote to memory of 3436	4840	rundll32.exe	56
PID 4840 wrote to memory of 3436	4840	rundll32.exe	56
PID 4840 wrote to memory of 1764	4840	rundll32.exe	37
PID 4840 wrote to memory of 1764	4840	rundll32.exe	37