31c40410bc1a9641a8125f3842803184553fd37c743e0e2f032752149ca38e50

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 21:41

Target

43728144bda5eb32bd86a2496debb134_JaffaCakes118.dll
Size

22KB
MD5

43728144bda5eb32bd86a2496debb134
SHA1

b01152708263b95898559335e4add814ad3690fb
SHA256

31c40410bc1a9641a8125f3842803184553fd37c743e0e2f032752149ca38e50
SHA512

ff4a0a6bc1c5dc4f67eebc668caf2df50026fed7634cade368617daeb4b719c5650be2c059501426a3efc02e6c50590c7a9534188a04674937721b29bf3def79
SSDEEP

384:jX2vDTAKZT/gcLdJBeGRswsaaUmFu4lKmTPTs8xFGEzYWafTFezYVc95J:D2XhT/9r3RPSUAz1PTsIsKvzYg5J

Score

8^/10

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Suspicious behavior: EnumeratesProcesses 20 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31
PID 2308 wrote to memory of 2216	2308	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43728144bda5eb32bd86a2496debb134_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43728144bda5eb32bd86a2496debb134_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2216-2-0x000000002000F000-0x0000000020010000-memory.dmp

Filesize
4KB

Download
memory/2216-1-0x0000000020000000-0x0000000020016000-memory.dmp

Filesize
88KB

Download
memory/2216-0-0x0000000020000000-0x0000000020016000-memory.dmp

Filesize
88KB

Download