0972820c00ed681f20d994baeda242ca2375c9db53cbfd1a2f2845b5d71233c3

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 20:15

Target

004c1926e39fd780f880a848d84c68fd_JaffaCakes118.dll
Size

11KB
MD5

004c1926e39fd780f880a848d84c68fd
SHA1

79e183f46d662cef782538d683a96d8516cce972
SHA256

0972820c00ed681f20d994baeda242ca2375c9db53cbfd1a2f2845b5d71233c3
SHA512

f5946b28347b93a2e54b3cd77a8a6535d30cae802de6a9fb80e59349c4dab85e24ac6249d9d5fd3e655da30a1b2751bbac88675990f1c5af69a5104f533ce0b8
SSDEEP

192:b9FFE0dfVOmwvmCz3iPuq2/1WlAxTLszhcL9FmOhqWKGYnjaxONhLMikgUw9bKj:brFxRjwnzymqYxuhcL94O8VjqONNw2Kj

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1740	1700	rundll32.exe	28
PID 1700 wrote to memory of 1740	1700	rundll32.exe	28
PID 1700 wrote to memory of 1740	1700	rundll32.exe	28
PID 1700 wrote to memory of 1740	1700	rundll32.exe	28
PID 1700 wrote to memory of 1740	1700	rundll32.exe	28
PID 1700 wrote to memory of 1740	1700	rundll32.exe	28
PID 1700 wrote to memory of 1740	1700	rundll32.exe	28
PID 1740 wrote to memory of 1196	1740	rundll32.exe	21

memory/1196-5-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1740-0-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download
memory/1740-2-0x000000000F00D000-0x000000000F00E000-memory.dmp

Filesize
4KB

Download
memory/1740-1-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download