69cc2ce2101942018a1d0ad6e827f0edec1be2ce123638de74ed0df6dc59410f

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 15:49

Target

5c99a3cc2575280d0a8042123d633b10_JaffaCakes118.dll
Size

12KB
MD5

5c99a3cc2575280d0a8042123d633b10
SHA1

d78bac7b32d92795e5aab9b862e7134d8ddce614
SHA256

69cc2ce2101942018a1d0ad6e827f0edec1be2ce123638de74ed0df6dc59410f
SHA512

9f8c0170caa029faf48936ce5caba707d79f42ca03fbd40e8d73c08f8dc64c6b97f1b5ab6e77046b20986613fa147a18b4ca88e80bfefd4f17bf5206711749a8
SSDEEP

192:jl706uPinf5qmXkN5Cib5ruhSUgDf+DQsZSKZGDoRGb1XaWVjhV7DmQFp7FUkgUx:jlA6myplBhSU+d0S5cGb13HD1x

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4576	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4576	3820	rundll32.exe	84
PID 3820 wrote to memory of 4576	3820	rundll32.exe	84
PID 3820 wrote to memory of 4576	3820	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c99a3cc2575280d0a8042123d633b10_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c99a3cc2575280d0a8042123d633b10_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4576

memory/4576-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download