ad2d26873d59840fd59818f0e896ee41c8354ddc0d9935a3e3eb19c365aa912f

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 21:30

Target

4b7c1bef99558ef4c5c1ad5633de012f_JaffaCakes118.dll
Size

90KB
MD5

4b7c1bef99558ef4c5c1ad5633de012f
SHA1

298a901746284ad5846eb6e6726b53985b3f8d0c
SHA256

ad2d26873d59840fd59818f0e896ee41c8354ddc0d9935a3e3eb19c365aa912f
SHA512

410175d52a81a6a42045add3c78040b4f605710c3db03ab70aadb9ec849f119d8a2d66f0f632bb403f8a0f648f7b488e3566ce4de0338d7033bbc8d0db710cbd
SSDEEP

1536:K+ygu9An3BhWOr6rf8R784bKm7uLf6nNtC3XAP0sHNVl9rIxFi44HF:K+nu9An3tr6b8OQ5E6uO06NVl9rIxFi/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	688	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
688	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 2152 wrote to memory of 688	2152	rundll32.exe	29
PID 688 wrote to memory of 596	688	rundll32.exe	9
PID 688 wrote to memory of 1760	688	rundll32.exe	30
PID 688 wrote to memory of 1760	688	rundll32.exe	30
PID 688 wrote to memory of 1760	688	rundll32.exe	30
PID 688 wrote to memory of 1760	688	rundll32.exe	30

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:596

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7c1bef99558ef4c5c1ad5633de012f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7c1bef99558ef4c5c1ad5633de012f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 328
    3⤵
    - Program crash
    PID:1760

memory/596-0-0x00000000003A0000-0x00000000003BE000-memory.dmp

Filesize
120KB

Download