ad2d26873d59840fd59818f0e896ee41c8354ddc0d9935a3e3eb19c365aa912f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 21:30

Target

4b7c1bef99558ef4c5c1ad5633de012f_JaffaCakes118.dll
Size

90KB
MD5

4b7c1bef99558ef4c5c1ad5633de012f
SHA1

298a901746284ad5846eb6e6726b53985b3f8d0c
SHA256

ad2d26873d59840fd59818f0e896ee41c8354ddc0d9935a3e3eb19c365aa912f
SHA512

410175d52a81a6a42045add3c78040b4f605710c3db03ab70aadb9ec849f119d8a2d66f0f632bb403f8a0f648f7b488e3566ce4de0338d7033bbc8d0db710cbd
SSDEEP

1536:K+ygu9An3BhWOr6rf8R784bKm7uLf6nNtC3XAP0sHNVl9rIxFi44HF:K+nu9An3tr6b8OQ5E6uO06NVl9rIxFi/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4492	4928	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4928	rundll32.exe
4928	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4928	4684	rundll32.exe	83
PID 4684 wrote to memory of 4928	4684	rundll32.exe	83
PID 4684 wrote to memory of 4928	4684	rundll32.exe	83
PID 4928 wrote to memory of 792	4928	rundll32.exe	10

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:792

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7c1bef99558ef4c5c1ad5633de012f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7c1bef99558ef4c5c1ad5633de012f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 716
    3⤵
    - Program crash
    PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4928 -ip 4928
1⤵
PID:4952