63f0c4b45f2bfa3357af91442e6db86321e2b8c410991b2010951f5065491db9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 02:54

Target

02345b85271ff106fb46e0cb0a2d7af2_JaffaCakes118.dll
Size

11KB
MD5

02345b85271ff106fb46e0cb0a2d7af2
SHA1

cf9e2f297c08e2c2714ecb598ffbf211eec111d8
SHA256

63f0c4b45f2bfa3357af91442e6db86321e2b8c410991b2010951f5065491db9
SHA512

9f3fe26195be5565ea0effdbc0214d852bed0794deaa2040fe3a8123228477c6b7e4fd224cace8c602c1179c0c96bad2b29d7df6018a2e2b504d48030c86e08f
SSDEEP

192:bKx95s9DCUPES+xH9ViTE1+WRHqUYwxIeuIAuQmbeYU08HMHsKw1346d0PkgUw9L:k9q9mQgHVcKKUdxIe6lfYMUsK4I6qwE

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 3016 wrote to memory of 2192	3016	rundll32.exe	28
PID 2192 wrote to memory of 1208	2192	rundll32.exe	21

memory/1208-2-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2192-4-0x000000000F00D000-0x000000000F00E000-memory.dmp

Filesize
4KB

Download
memory/2192-3-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download