69cc2ce2101942018a1d0ad6e827f0edec1be2ce123638de74ed0df6dc59410f

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 15:49

Target

5c99a3cc2575280d0a8042123d633b10_JaffaCakes118.dll
Size

12KB
MD5

5c99a3cc2575280d0a8042123d633b10
SHA1

d78bac7b32d92795e5aab9b862e7134d8ddce614
SHA256

69cc2ce2101942018a1d0ad6e827f0edec1be2ce123638de74ed0df6dc59410f
SHA512

9f8c0170caa029faf48936ce5caba707d79f42ca03fbd40e8d73c08f8dc64c6b97f1b5ab6e77046b20986613fa147a18b4ca88e80bfefd4f17bf5206711749a8
SSDEEP

192:jl706uPinf5qmXkN5Cib5ruhSUgDf+DQsZSKZGDoRGb1XaWVjhV7DmQFp7FUkgUx:jlA6myplBhSU+d0S5cGb13HD1x

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c99a3cc2575280d0a8042123d633b10_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c99a3cc2575280d0a8042123d633b10_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2160

memory/2160-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2160-2-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2160-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2160-3-0x000000001000E000-0x000000001000F000-memory.dmp

Filesize
4KB

Download