5fe27d4274b6bed8d42359b16bb4fa29b9dd37872bf2031a1a649e278a96bc2a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 13:12

Target

41d048fa3d6db13e365905746bdcaa01_JaffaCakes118.dll
Size

606KB
MD5

41d048fa3d6db13e365905746bdcaa01
SHA1

f6ea1caaf9dd61eb81bc5b6a83da9ec67fdc0c57
SHA256

5fe27d4274b6bed8d42359b16bb4fa29b9dd37872bf2031a1a649e278a96bc2a
SHA512

fed5754f24a446c7e45027bff0e23278b127fcb2f1a7272299855aa0a1e3d7d3bdc4dee6d0dd6d35c0e8976f65e5e2bb4c2164352551b8028ae91c2745ba1017
SSDEEP

12288:yNT95YDf+m65/OJs7EtcH1lH2/7HzDtq/cYzqhmfxtNaZtrwdgKVx:YVlHQ7H0FzEQxtUZt

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2628	WerFault.exe	30

Kills process with taskkill 1 IoCs

evasion

pid	Process
2248	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2628	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2628	3048	rundll32.exe	30
PID 3048 wrote to memory of 2628	3048	rundll32.exe	30
PID 3048 wrote to memory of 2628	3048	rundll32.exe	30
PID 3048 wrote to memory of 2628	3048	rundll32.exe	30
PID 3048 wrote to memory of 2628	3048	rundll32.exe	30
PID 3048 wrote to memory of 2628	3048	rundll32.exe	30
PID 3048 wrote to memory of 2628	3048	rundll32.exe	30
PID 2628 wrote to memory of 2248	2628	rundll32.exe	31
PID 2628 wrote to memory of 2248	2628	rundll32.exe	31
PID 2628 wrote to memory of 2248	2628	rundll32.exe	31
PID 2628 wrote to memory of 2248	2628	rundll32.exe	31
PID 2628 wrote to memory of 2688	2628	rundll32.exe	34
PID 2628 wrote to memory of 2688	2628	rundll32.exe	34
PID 2628 wrote to memory of 2688	2628	rundll32.exe	34
PID 2628 wrote to memory of 2688	2628	rundll32.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41d048fa3d6db13e365905746bdcaa01_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41d048fa3d6db13e365905746bdcaa01_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 236
    3⤵
    - Program crash
    PID:2688