73d1e419c35c5dd4db9c782d012fa1318fa66ac857d2d59a309462157c10978d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:22

Target

470783423ecebee295611b483421c863_JaffaCakes118.dll
Size

21KB
MD5

470783423ecebee295611b483421c863
SHA1

e51f5924ed3a1cc67ac5d4d96f1e3fb4ff5bdd11
SHA256

73d1e419c35c5dd4db9c782d012fa1318fa66ac857d2d59a309462157c10978d
SHA512

c60461f161a1e168b9f299034011883416c24d65b1eaba50eff6268b427328101dc08971ed136f95154048bd743b92793789cfd1951bc42506c9a213bd1cd086
SSDEEP

384:iQeVEut5WXGIuXNA5OIWLabXPJX/PnTV5QIEgsJ8hWLxgWs4qy3G:sE+Iu6yLWJ5exa4q/

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1996	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31
PID 484 wrote to memory of 1996	484	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\470783423ecebee295611b483421c863_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\470783423ecebee295611b483421c863_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1996

memory/1996-0-0x0000000074AD0000-0x0000000074AD9000-memory.dmp

Filesize
36KB

Download