fbd6416060e3d446088838ec17fdc5b2238e76689956a5e6dd01091e77dba81f

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 14:57

Target

42294ecb2e499533c8db16025cc901b6_JaffaCakes118.dll
Size

322KB
MD5

42294ecb2e499533c8db16025cc901b6
SHA1

baa6d0c81cbdb5a5e6bb2699f0917bb40c9569f0
SHA256

fbd6416060e3d446088838ec17fdc5b2238e76689956a5e6dd01091e77dba81f
SHA512

0cda76436352cc3a30a1adb33f55a608e158fb4599859be5c9fcca1d22bf909bd3d0100ffb0a22c098e515ec98cbc57bb4d5fab36448b94a2df0ec88cca140af
SSDEEP

3072:pXP/MN1yX++VjZf5gGmXKlOJ7UgiypovUjBlk8LKXknmi/HljH+G5MLBAxn25TWu:pf03yX++VjZm6sd74i/4GLnYyYDJXT

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1036	4704	WerFault.exe	83
944	4704	WerFault.exe	83

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4704	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4704	4544	rundll32.exe	83
PID 4544 wrote to memory of 4704	4544	rundll32.exe	83
PID 4544 wrote to memory of 4704	4544	rundll32.exe	83
PID 4704 wrote to memory of 380	4704	rundll32.exe	88
PID 4704 wrote to memory of 380	4704	rundll32.exe	88
PID 4704 wrote to memory of 380	4704	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42294ecb2e499533c8db16025cc901b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42294ecb2e499533c8db16025cc901b6_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 840
    3⤵
    - Program crash
    PID:1036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 644
    3⤵
    - Program crash
    PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4704 -ip 4704
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4704 -ip 4704
1⤵
PID:4876

memory/4704-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4704-1-0x0000000000600000-0x0000000000653000-memory.dmp

Filesize
332KB

Download
memory/4704-2-0x0000000000601000-0x0000000000604000-memory.dmp

Filesize
12KB

Download
memory/4704-3-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download
memory/4704-4-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download
memory/4704-6-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4704-5-0x0000000000600000-0x0000000000653000-memory.dmp

Filesize
332KB

Download