44fc6f1ddf762ce0718ccd17a0f9c64af04065ab3cf3d8a350eb6a69061f2213

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 00:32

Target

370745c909a3c059e59ab1695f995ac4_JaffaCakes118.dll
Size

47KB
MD5

370745c909a3c059e59ab1695f995ac4
SHA1

51b178af6b4d0d4a1cafc85b3a6bcfac4b185e07
SHA256

44fc6f1ddf762ce0718ccd17a0f9c64af04065ab3cf3d8a350eb6a69061f2213
SHA512

5caab34651fe7771f36025e7d06dbee7265ea7b49a2131d5aa2baabcfc25c1d6f93f2b0d3d4dcffb7b16623080d1d6f3cca7f7260a1fe08152e1f1346fbcf467
SSDEEP

768:frz6XkhDWsdaT0vgB0wUBjTkFlKEOPHM97idj+RZ46BuC28Yf:frz6XmDjaAvgB0wcfkFlK5MpuwZ4e2

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dehkj.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\dehkj.dll	rundll32.exe
File created	C:\Windows\SysWOW64\dtrgjy.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\dtrgjy.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 3096	3464	rundll32.exe	83
PID 3464 wrote to memory of 3096	3464	rundll32.exe	83
PID 3464 wrote to memory of 3096	3464	rundll32.exe	83
PID 3096 wrote to memory of 3420	3096	rundll32.exe	56
PID 3096 wrote to memory of 3420	3096	rundll32.exe	56
PID 3096 wrote to memory of 1692	3096	rundll32.exe	37
PID 3096 wrote to memory of 1692	3096	rundll32.exe	37