b79b5e1982ed075c377cab0a0749fe4618dabc3b75e79ab9232fac77c81b7fe4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:16

Target

31a3d87dfcd90c0f3b467cf47b98ced5_JaffaCakes118.dll
Size

11KB
MD5

31a3d87dfcd90c0f3b467cf47b98ced5
SHA1

a146028bf058cd570b62432de1d5a58b727fd4b8
SHA256

b79b5e1982ed075c377cab0a0749fe4618dabc3b75e79ab9232fac77c81b7fe4
SHA512

8e859eb8fc84c367bada7eedca0b5893e83149d5079724b8f2efe0e4b9d6facc305c799ecf5c6ec6114df5356a57560ab4bd04a7fc33afab23b93f3a33badb47
SSDEEP

192:Qop9QuF89psKA0TFAh5Oi1elyUMaGmfqMwmZsPZgoWDKQNwy1lbxcx/f4+n9kP6e:Qopv4pUqIxelyUCK2ZnWD9/p+9KOK

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2680	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2680	2516	rundll32.exe	30
PID 2516 wrote to memory of 2680	2516	rundll32.exe	30
PID 2516 wrote to memory of 2680	2516	rundll32.exe	30
PID 2516 wrote to memory of 2680	2516	rundll32.exe	30
PID 2516 wrote to memory of 2680	2516	rundll32.exe	30
PID 2516 wrote to memory of 2680	2516	rundll32.exe	30
PID 2516 wrote to memory of 2680	2516	rundll32.exe	30
PID 2680 wrote to memory of 428	2680	rundll32.exe	5

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31a3d87dfcd90c0f3b467cf47b98ced5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31a3d87dfcd90c0f3b467cf47b98ced5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2680

memory/428-2-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/2680-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2680-1-0x000000001000B000-0x000000001000C000-memory.dmp

Filesize
4KB

Download