5ba715d4907f31e1c0865b2aba6a71d9b6c408b9f40fb1f9647ff961030fd394

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 14:27

Target

4a10a67de31efade139236db108a20c3_JaffaCakes118.dll
Size

24KB
MD5

4a10a67de31efade139236db108a20c3
SHA1

c68cd821d1018348d8417a736a782d1f30a8a647
SHA256

5ba715d4907f31e1c0865b2aba6a71d9b6c408b9f40fb1f9647ff961030fd394
SHA512

5470355f4b22d4ef2866c73e97c59859441e35f3a5cb2bbb8adaf40c002f41303817c7a6a088e15568ea5352339d8332d0995c96bfe8544149b2284ae78fc7f6
SSDEEP

384:Bu+ppFiUEAutfcrUi2x7VEnRKTQd04NJBN2DDg1:fbshf0Ui2IRKTi0uB8DA

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4828	4536	rundll32.exe	83
PID 4536 wrote to memory of 4828	4536	rundll32.exe	83
PID 4536 wrote to memory of 4828	4536	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a10a67de31efade139236db108a20c3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a10a67de31efade139236db108a20c3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4828

memory/4828-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download