15a20d01244662f1b3f198c40088bacc2c64f356a204b9a7f8e2994f9bbbdd6f

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 19:27

Target

31ab5ba52cfc87355f4016aeec8fc4d3_JaffaCakes118.dll
Size

52KB
MD5

31ab5ba52cfc87355f4016aeec8fc4d3
SHA1

0c3a96aac6d89dd5790f0942791bae1bb815b696
SHA256

15a20d01244662f1b3f198c40088bacc2c64f356a204b9a7f8e2994f9bbbdd6f
SHA512

c13f80f2ba50f9869aeacf9af1c25fa01af60882c056184c1d5777ee48209b548c91642ed6176ff66bae0a265cfe8f038a7dfe3e2a8fa90e2c15c171e030cb92
SSDEEP

768:YPMjVOQV9ggpjzJjWXlhONfCJGn8X7wMJMctb3FHrUpJQetCopAezpag:nROs99NW/ONtn8X7wMJh7FLGFV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	4796	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4796	2384	rundll32.exe	81
PID 2384 wrote to memory of 4796	2384	rundll32.exe	81
PID 2384 wrote to memory of 4796	2384	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31ab5ba52cfc87355f4016aeec8fc4d3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31ab5ba52cfc87355f4016aeec8fc4d3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1236
    3⤵
    - Program crash
    PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4796 -ip 4796
1⤵
PID:4264

memory/4796-0-0x0000000000B90000-0x0000000000B9C000-memory.dmp

Filesize
48KB

Download
memory/4796-1-0x0000000000B90000-0x0000000000B9C000-memory.dmp

Filesize
48KB

Download
memory/4796-2-0x0000000074DC0000-0x0000000074DD4000-memory.dmp

Filesize
80KB

Download