7d0a3ac94d75d4b53bf440ccda5e26502a01b46d30254b2c761fca399456739a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 19:06

Target

3a62d7f22de7a0788f3669ef4c74677c_JaffaCakes118.dll
Size

4KB
MD5

3a62d7f22de7a0788f3669ef4c74677c
SHA1

069b78725c8090e2ec60cc97902da2a1cc5c244a
SHA256

7d0a3ac94d75d4b53bf440ccda5e26502a01b46d30254b2c761fca399456739a
SHA512

552c32d9651db16c0c534299745342dc4c6b3edceddf704a6952c288aa25ac8dece1250965b9143d6b2d0de57b54baf7d1d19468200185b4b5c4dd9467e9a85c
SSDEEP

96:vdE5T/LYCVfV/d0OnV5/Vw9pQZbSfkgcwQwTKsa:vCl3fxSeju6GfkgUwusa

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	rundll32.exe
2468	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 2468 wrote to memory of 1168	2468	rundll32.exe	20

memory/1168-2-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/2468-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2468-1-0x0000000010007000-0x0000000010008000-memory.dmp

Filesize
4KB

Download