b79b5e1982ed075c377cab0a0749fe4618dabc3b75e79ab9232fac77c81b7fe4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 19:16

Target

31a3d87dfcd90c0f3b467cf47b98ced5_JaffaCakes118.dll
Size

11KB
MD5

31a3d87dfcd90c0f3b467cf47b98ced5
SHA1

a146028bf058cd570b62432de1d5a58b727fd4b8
SHA256

b79b5e1982ed075c377cab0a0749fe4618dabc3b75e79ab9232fac77c81b7fe4
SHA512

8e859eb8fc84c367bada7eedca0b5893e83149d5079724b8f2efe0e4b9d6facc305c799ecf5c6ec6114df5356a57560ab4bd04a7fc33afab23b93f3a33badb47
SSDEEP

192:Qop9QuF89psKA0TFAh5Oi1elyUMaGmfqMwmZsPZgoWDKQNwy1lbxcx/f4+n9kP6e:Qopv4pUqIxelyUCK2ZnWD9/p+9KOK

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	rundll32.exe
3000	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3000	2912	rundll32.exe	81
PID 2912 wrote to memory of 3000	2912	rundll32.exe	81
PID 2912 wrote to memory of 3000	2912	rundll32.exe	81
PID 3000 wrote to memory of 608	3000	rundll32.exe	5

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31a3d87dfcd90c0f3b467cf47b98ced5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31a3d87dfcd90c0f3b467cf47b98ced5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3000

memory/3000-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download