4b2fc18cabddfbdee2677f23c4780c365cdfe1a2ee3810d57f6f04de26e52fbe

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:07

Target

3662b29282545a87370b41aa00e18b9d_JaffaCakes118.dll
Size

13KB
MD5

3662b29282545a87370b41aa00e18b9d
SHA1

b364298cb41e893df4e70e53b9cf1e19dd4612f6
SHA256

4b2fc18cabddfbdee2677f23c4780c365cdfe1a2ee3810d57f6f04de26e52fbe
SHA512

b383d2735d602043fee4d264b157efa560185d4cdee0064acf1a2b72b306b02fcaccb0e5a5622d32d5cb3ddabe29721a5d19e6d581845a396d63facc90534b91
SSDEEP

384:foHNSTRf1P73V6p5XXd4k61FF1TJo1yg6F:foHNefVgWk61Fdn

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2960 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 2960 rundll32.exe

pid	process
2960	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2960	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2944 wrote to memory of 2960	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2960	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2960	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2960	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2960	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2960	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2960	2944	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 432	2960	rundll32.exe	winlogon.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3662b29282545a87370b41aa00e18b9d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944

memory/432-3-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/2960-6-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2960-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2960-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2960-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2960-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download