3b81279a652debf68e5824e9de36e5902416af1a2e9296cfa92c7bdb417c0140

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 07:41

Target

3c83a7a880bda6f7d3fb9d2226704ee3_JaffaCakes118.dll
Size

32KB
MD5

3c83a7a880bda6f7d3fb9d2226704ee3
SHA1

759e92b47aa40c55766f4345f9bc24e2f2ddb581
SHA256

3b81279a652debf68e5824e9de36e5902416af1a2e9296cfa92c7bdb417c0140
SHA512

542e4f162fa2607edda1a19ef7ddeb47b53530e1f24453c0e2fadbfd554b0d72dd158db962714ca62bb99b5e363d0b7369fe3ef09de03f6a521cdfd0785aaa2f
SSDEEP

384:H3iISNg65cQCXSPnD7uJtUU86/W9HbPTom3fxACpH+gvZSICMS9:HSN99CCnD7uJtUU86/qHbPH7pH+UZli9

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File created	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2700	2704	rundll32.exe	30
PID 2704 wrote to memory of 2700	2704	rundll32.exe	30
PID 2704 wrote to memory of 2700	2704	rundll32.exe	30
PID 2704 wrote to memory of 2700	2704	rundll32.exe	30
PID 2704 wrote to memory of 2700	2704	rundll32.exe	30
PID 2704 wrote to memory of 2700	2704	rundll32.exe	30
PID 2704 wrote to memory of 2700	2704	rundll32.exe	30
PID 2700 wrote to memory of 1200	2700	rundll32.exe	21
PID 2700 wrote to memory of 1200	2700	rundll32.exe	21
PID 2700 wrote to memory of 1068	2700	rundll32.exe	17
PID 2700 wrote to memory of 1068	2700	rundll32.exe	17

memory/1200-2-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download