f903d21c6f2fe1e4830bdab57efdf6f204ecb812c2308609fb861320dd2a5d44

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 22:34

Target

4bb2c4f78982bbd28e084fde6cf11280_JaffaCakes118.dll
Size

9KB
MD5

4bb2c4f78982bbd28e084fde6cf11280
SHA1

fe82de9cbc341ee4233b0bcc586a8be210c79ec2
SHA256

f903d21c6f2fe1e4830bdab57efdf6f204ecb812c2308609fb861320dd2a5d44
SHA512

34fb12cee8f108d4f85f6cb637f6b430ae316183def13f3f47ecf6650833de20771cb1ed6da09122797742d0cf21de11305f39d0b14ab83ac070a3e2940d3a1e
SSDEEP

96:TNld015Ojykvh8ZNkPGzlvbqrvsbUa9f9d9oS+BfObXp/Q9w2BT:W1IyMh8+GzlvbqAbDITObXlGBT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2748	rundll32.exe
2748	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2748	2092	rundll32.exe	30
PID 2092 wrote to memory of 2748	2092	rundll32.exe	30
PID 2092 wrote to memory of 2748	2092	rundll32.exe	30
PID 2092 wrote to memory of 2748	2092	rundll32.exe	30
PID 2092 wrote to memory of 2748	2092	rundll32.exe	30
PID 2092 wrote to memory of 2748	2092	rundll32.exe	30
PID 2092 wrote to memory of 2748	2092	rundll32.exe	30
PID 2748 wrote to memory of 1096	2748	rundll32.exe	20

memory/1096-0-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download