9e27b7751a2f5fdc1fbc32403a4b980cf8c0b35b4a5f402410b298c55a6179e8

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 00:24

Target

01688a2313497ac967370420d20960b4_JaffaCakes118.dll
Size

14KB
MD5

01688a2313497ac967370420d20960b4
SHA1

56fa50d48bb0951ce833372db38751ffbfe27550
SHA256

9e27b7751a2f5fdc1fbc32403a4b980cf8c0b35b4a5f402410b298c55a6179e8
SHA512

346b8a72a316177e5da02fc57fea9132f15bf59fe4fa176321e00f3fecc29e52742782d93a0d25694107d650c536a42fdf57dc327f50a2c22f498b7a167ae731
SSDEEP

192:/3DRvoKMZKh5dV9yuDg7JkgOr4C0okzslUBAr/Rov+3sXqy1HlkkgUw9gyrpvit3:LVJM25d2hkgAaiRov+c6MBOvilm1Qt

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1756	2652	rundll32.exe	28
PID 2652 wrote to memory of 1756	2652	rundll32.exe	28
PID 2652 wrote to memory of 1756	2652	rundll32.exe	28
PID 2652 wrote to memory of 1756	2652	rundll32.exe	28
PID 2652 wrote to memory of 1756	2652	rundll32.exe	28
PID 2652 wrote to memory of 1756	2652	rundll32.exe	28
PID 2652 wrote to memory of 1756	2652	rundll32.exe	28
PID 1756 wrote to memory of 1356	1756	rundll32.exe	21

memory/1356-4-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1756-1-0x000000000F00D000-0x000000000F00E000-memory.dmp

Filesize
4KB

Download
memory/1756-0-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download