c12113d8f210eaf4b8514d9c227459d4388aaa00a6730a315ee06e48331e598f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 20:25

Target

64ad249c2f4f209be99c2594992c6dfb_JaffaCakes118.dll
Size

107KB
MD5

64ad249c2f4f209be99c2594992c6dfb
SHA1

fe293fdd4296cdd996b7af16f92baf4456016329
SHA256

c12113d8f210eaf4b8514d9c227459d4388aaa00a6730a315ee06e48331e598f
SHA512

b2313f157fc9aa68ad0a9e47e6ce5f542d2ba31b1e3bdddb8d9a7a36538c2e6014b2b32110cff4033b0c68e852a813fdc05c322637fa67cf34d558b4dd0eed03
SSDEEP

3072:/PacRZVXzbz4ywd+gD6d38qNtFq+J8/XDr6zBrUfA:X1RZF74Jd+geNVtzIXPoBQfA

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Win.ini	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4184	3704	rundll32.exe	84
PID 3704 wrote to memory of 4184	3704	rundll32.exe	84
PID 3704 wrote to memory of 4184	3704	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64ad249c2f4f209be99c2594992c6dfb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64ad249c2f4f209be99c2594992c6dfb_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4184

memory/4184-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/4184-1-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download