3b81279a652debf68e5824e9de36e5902416af1a2e9296cfa92c7bdb417c0140

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 07:41

Target

3c83a7a880bda6f7d3fb9d2226704ee3_JaffaCakes118.dll
Size

32KB
MD5

3c83a7a880bda6f7d3fb9d2226704ee3
SHA1

759e92b47aa40c55766f4345f9bc24e2f2ddb581
SHA256

3b81279a652debf68e5824e9de36e5902416af1a2e9296cfa92c7bdb417c0140
SHA512

542e4f162fa2607edda1a19ef7ddeb47b53530e1f24453c0e2fadbfd554b0d72dd158db962714ca62bb99b5e363d0b7369fe3ef09de03f6a521cdfd0785aaa2f
SSDEEP

384:H3iISNg65cQCXSPnD7uJtUU86/W9HbPTom3fxACpH+gvZSICMS9:HSN99CCnD7uJtUU86/qHbPH7pH+UZli9

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe
File created	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 3096	1420	rundll32.exe	83
PID 1420 wrote to memory of 3096	1420	rundll32.exe	83
PID 1420 wrote to memory of 3096	1420	rundll32.exe	83
PID 3096 wrote to memory of 3432	3096	rundll32.exe	56
PID 3096 wrote to memory of 3432	3096	rundll32.exe	56
PID 3096 wrote to memory of 2120	3096	rundll32.exe	38
PID 3096 wrote to memory of 2120	3096	rundll32.exe	38