851f50defa51bd8f892419eb88c0a77887e12f53f79a9d5cf44c93b2a3937a1f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 15:52

Target

077797d8b06c7e2e4181385cd063943c_JaffaCakes118.dll
Size

27KB
MD5

077797d8b06c7e2e4181385cd063943c
SHA1

6781639cb36231d074cd01f3621546a3df3208ef
SHA256

851f50defa51bd8f892419eb88c0a77887e12f53f79a9d5cf44c93b2a3937a1f
SHA512

e369897a90f453be48b7ecaac2880abfbddf1bbaa06409934466083516330ec6f740c79a642b50f8eb162614db4ab97a90c734707bff83b94b7b809cb69413f9
SSDEEP

384:fm9M/hwe70Bc3asjxWXKhZsjzpj0dk5UHP9vPq/hc9ZYAbw1cZ7qDXK:fm2/3aw1GQsjzpj0dk5UHP6nAbWcZmG

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2648	2084	rundll32.exe	28
PID 2084 wrote to memory of 2648	2084	rundll32.exe	28
PID 2084 wrote to memory of 2648	2084	rundll32.exe	28
PID 2084 wrote to memory of 2648	2084	rundll32.exe	28
PID 2084 wrote to memory of 2648	2084	rundll32.exe	28
PID 2084 wrote to memory of 2648	2084	rundll32.exe	28
PID 2084 wrote to memory of 2648	2084	rundll32.exe	28
PID 2648 wrote to memory of 1260	2648	rundll32.exe	21

memory/1260-2-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download