e72d7866710eb8f7fb38670b337aeb2a00f237e91f400c3f82497438fca4d36c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 09:37

Target

38989ccea0436eb7c1e575c73ac20a5e_JaffaCakes118.dll
Size

223KB
MD5

38989ccea0436eb7c1e575c73ac20a5e
SHA1

71fe1cd3bc4854467a3baafbd3c4c59ad650f0ae
SHA256

e72d7866710eb8f7fb38670b337aeb2a00f237e91f400c3f82497438fca4d36c
SHA512

b0a12672610f11b9bc08cced481a579a65c6afda826891313e1e903fd0228e90c680422e779151dffc3731368afd79b65051a580d446710a0bdfc7950e9176df
SSDEEP

6144:xK6TouN8b3sgHw1DcTfrTeD8bf1fUob7F94E:xK6ExsJD81ffXF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2936	rundll32.exe
Token: SeSecurityPrivilege	2936	rundll32.exe
Token: SeTakeOwnershipPrivilege	2936	rundll32.exe
Token: SeLoadDriverPrivilege	2936	rundll32.exe
Token: SeSystemProfilePrivilege	2936	rundll32.exe
Token: SeSystemtimePrivilege	2936	rundll32.exe
Token: SeProfSingleProcessPrivilege	2936	rundll32.exe
Token: SeIncBasePriorityPrivilege	2936	rundll32.exe
Token: SeCreatePagefilePrivilege	2936	rundll32.exe
Token: SeShutdownPrivilege	2936	rundll32.exe
Token: SeDebugPrivilege	2936	rundll32.exe
Token: SeSystemEnvironmentPrivilege	2936	rundll32.exe
Token: SeRemoteShutdownPrivilege	2936	rundll32.exe
Token: SeUndockPrivilege	2936	rundll32.exe
Token: SeManageVolumePrivilege	2936	rundll32.exe
Token: 33	2936	rundll32.exe
Token: 34	2936	rundll32.exe
Token: 35	2936	rundll32.exe
Token: 36	2936	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2936	3908	rundll32.exe	82
PID 3908 wrote to memory of 2936	3908	rundll32.exe	82
PID 3908 wrote to memory of 2936	3908	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38989ccea0436eb7c1e575c73ac20a5e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38989ccea0436eb7c1e575c73ac20a5e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2936

memory/2936-0-0x0000000000E70000-0x0000000000F19000-memory.dmp

Filesize
676KB

Download