0b0d99cdab7936759a87226ac9feb6b382566675a7aff6e6ce220e7a80ec250d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:36

Target

3a1b7e192c251caa9e1223ae0472a246_JaffaCakes118.dll
Size

21KB
MD5

3a1b7e192c251caa9e1223ae0472a246
SHA1

88e9ddfe57eff5723079db67ae943df474789f51
SHA256

0b0d99cdab7936759a87226ac9feb6b382566675a7aff6e6ce220e7a80ec250d
SHA512

7040aa7aa4238615a234964c7fb207a9091336ab272174c5819b4da21a86f5a6669c505ee03c58549a8af74f47b8de44533e7b883cbe9f3892a2509ef628bf46
SSDEEP

384:b++kcJkLB3mA6NHxvHFgGfUsLFAzTR92J+:bHkB/6bCvsRAPL2J

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1808	780	rundll32.exe	31
PID 780 wrote to memory of 1808	780	rundll32.exe	31
PID 780 wrote to memory of 1808	780	rundll32.exe	31
PID 780 wrote to memory of 1808	780	rundll32.exe	31
PID 780 wrote to memory of 1808	780	rundll32.exe	31
PID 780 wrote to memory of 1808	780	rundll32.exe	31
PID 780 wrote to memory of 1808	780	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1b7e192c251caa9e1223ae0472a246_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1b7e192c251caa9e1223ae0472a246_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1808

memory/1808-0-0x0000000020000000-0x000000002000C000-memory.dmp

Filesize
48KB

Download