d221ceebbecfda7f8bd2a367ff03202c7046fa3c1a558b52d11eb58a216b87fb

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 10:06

Target

2ff15dd047cc94a4c53e15248d16a3ae_JaffaCakes118.dll
Size

123KB
MD5

2ff15dd047cc94a4c53e15248d16a3ae
SHA1

17b391338402aeda1e1df7d7505d3f1aedbe3fbe
SHA256

d221ceebbecfda7f8bd2a367ff03202c7046fa3c1a558b52d11eb58a216b87fb
SHA512

cbfbe518cbb78563af592502b1cf1011828c9e03aaa78381b11fb9e73c476b32954f7d2685192fc8d04640bc9f65330b04b1e3e56445e91e3f8c3fb5c4ef18be
SSDEEP

3072:WoUJQ+XG3JiIBs2k6ZSHuDY4x/QfBpR5Vdum:VUJQ+XG3JiSsTCSHuDBYJpfVY

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3816	rundll32.exe
3816	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3816	4508	rundll32.exe	89
PID 4508 wrote to memory of 3816	4508	rundll32.exe	89
PID 4508 wrote to memory of 3816	4508	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ff15dd047cc94a4c53e15248d16a3ae_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ff15dd047cc94a4c53e15248d16a3ae_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4256,i,3409420486566309625,12100452682816721435,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
1⤵
PID:3628

memory/3816-2-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/3816-1-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/3816-0-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/3816-3-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/3816-4-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download