c12113d8f210eaf4b8514d9c227459d4388aaa00a6730a315ee06e48331e598f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 20:25

Target

64ad249c2f4f209be99c2594992c6dfb_JaffaCakes118.dll
Size

107KB
MD5

64ad249c2f4f209be99c2594992c6dfb
SHA1

fe293fdd4296cdd996b7af16f92baf4456016329
SHA256

c12113d8f210eaf4b8514d9c227459d4388aaa00a6730a315ee06e48331e598f
SHA512

b2313f157fc9aa68ad0a9e47e6ce5f542d2ba31b1e3bdddb8d9a7a36538c2e6014b2b32110cff4033b0c68e852a813fdc05c322637fa67cf34d558b4dd0eed03
SSDEEP

3072:/PacRZVXzbz4ywd+gD6d38qNtFq+J8/XDr6zBrUfA:X1RZF74Jd+geNVtzIXPoBQfA

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Win.ini	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2688	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	2688	rundll32.exe
Token: SeRestorePrivilege	2688	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2688	1264	rundll32.exe	30
PID 1264 wrote to memory of 2688	1264	rundll32.exe	30
PID 1264 wrote to memory of 2688	1264	rundll32.exe	30
PID 1264 wrote to memory of 2688	1264	rundll32.exe	30
PID 1264 wrote to memory of 2688	1264	rundll32.exe	30
PID 1264 wrote to memory of 2688	1264	rundll32.exe	30
PID 1264 wrote to memory of 2688	1264	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64ad249c2f4f209be99c2594992c6dfb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64ad249c2f4f209be99c2594992c6dfb_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

memory/2688-1-0x0000000010007000-0x0000000010008000-memory.dmp

Filesize
4KB

Download
memory/2688-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download