7ded52b59d5ba17adec6f3ec43144689a730aeb750c388318cac81cb7ded6f09

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 09:48

Target

3437b1df9eb1b9e219cbc317223b3ed3_JaffaCakes118.dll
Size

704KB
MD5

3437b1df9eb1b9e219cbc317223b3ed3
SHA1

aba91bfeb3f35698132bdd4d02ab21df0b8186fb
SHA256

7ded52b59d5ba17adec6f3ec43144689a730aeb750c388318cac81cb7ded6f09
SHA512

9e807ad8c877e2cb5cf488a4cecdc83486627cb7b4d4b6f939485d972fc4a3b6ec1a7d823b83a1f6b964553303ac1323d3b42d1bf1c6dbeb8c1d7f693457ecaf
SSDEEP

12288:esYz9jM05nnxagKe3bk5LVFt1WEQCm+OU9tF:esYlfaqLkFVFtUvQFF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	rundll32.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30
PID 2568 wrote to memory of 2396	2568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3437b1df9eb1b9e219cbc317223b3ed3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3437b1df9eb1b9e219cbc317223b3ed3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2396