834e366589d2ce66f85e3dcc69aeecbae6499e219b966fef75f93c187481cc1d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 21:14

Target

3abc6b28a55c76f4924fae39d5323ad1_JaffaCakes118.dll
Size

60KB
MD5

3abc6b28a55c76f4924fae39d5323ad1
SHA1

a3ff89517723e23bc74e64fff82337d65844bb5b
SHA256

834e366589d2ce66f85e3dcc69aeecbae6499e219b966fef75f93c187481cc1d
SHA512

b90b27c5fa391311feb52fabaeda02fd0b873a6de15390fb419a3bbfc91bfc43c5192e4eb0e7cb3c30d15f37d49b3698cd3e30a661a1bfb83918f2329311da7f
SSDEEP

1536:VNqwLyQkjJLTA1kBrw4k2Eyq6erI/NKLB6eoWk:J+J58kBHFBqwFO6rN

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	300	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3abc6b28a55c76f4924fae39d5323ad1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3abc6b28a55c76f4924fae39d5323ad1_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:300