b6338e731c0ce90ba91a189b07f087f605576374db2d4a5c4fe1409def5e7e34

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 06:27

Target

2f4cb906a5a0275bb93700d239950a12_JaffaCakes118.dll
Size

33KB
MD5

2f4cb906a5a0275bb93700d239950a12
SHA1

96b9b1262787f6c1b28c9f8f3fdb57456bf46a5e
SHA256

b6338e731c0ce90ba91a189b07f087f605576374db2d4a5c4fe1409def5e7e34
SHA512

9ed988976f938d11eb1e09a2329f18eec474c16f6a5d066f3f7084224721b0cae4ad761776ddfc20c42666e9e558963642f9fdeece64623f5b4368259aa85e4c
SSDEEP

768:x+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:x+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1932	2692	rundll32.exe	30
PID 2692 wrote to memory of 1932	2692	rundll32.exe	30
PID 2692 wrote to memory of 1932	2692	rundll32.exe	30
PID 2692 wrote to memory of 1932	2692	rundll32.exe	30
PID 2692 wrote to memory of 1932	2692	rundll32.exe	30
PID 2692 wrote to memory of 1932	2692	rundll32.exe	30
PID 2692 wrote to memory of 1932	2692	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f4cb906a5a0275bb93700d239950a12_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f4cb906a5a0275bb93700d239950a12_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1932

memory/1932-0-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/1932-1-0x0000000075371000-0x0000000075372000-memory.dmp

Filesize
4KB

Download
memory/1932-2-0x0000000075370000-0x00000000753FD000-memory.dmp

Filesize
564KB

Download
memory/1932-3-0x0000000075370000-0x00000000753FD000-memory.dmp

Filesize
564KB

Download