8e8f08340c90449abd5a8bc2765c6578c0f52143eb337e57d802c72f1af2eb3f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 21:07

Target

f8bf649354c562918f760d6654fbe492_JaffaCakes118.dll
Size

10KB
MD5

f8bf649354c562918f760d6654fbe492
SHA1

f09f52b67c74b33be28aad9d6997dd7f736c54b2
SHA256

8e8f08340c90449abd5a8bc2765c6578c0f52143eb337e57d802c72f1af2eb3f
SHA512

37da30916eadaa5e07b69b9d3933d17db905a7d6313e561ee6920b71732d029a1960e514c36cd5ae48c76f3659f70d3739f482bf4014589c1b0d884bcf8e4e53
SSDEEP

192:PnWCINWJsJ2/A9gnngRG7tMpnIt0egsUm0/1/lEpKkgUw9hH:pINlkIGnqutKIt0egs+sFK

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 1904 wrote to memory of 1328	1904	rundll32.exe	21

memory/1328-3-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1904-0-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download