4ec3dcbf43a1bd38ddfb0856ef642f49c18e3591cfcb09682f38f2fc54d07656

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 15:57

Target

07821b7045fdcd6e8a6abebd6d796d52_JaffaCakes118.dll
Size

16KB
MD5

07821b7045fdcd6e8a6abebd6d796d52
SHA1

42aea80fd1fc871afcecec1f1ff5ee8a0abf4e60
SHA256

4ec3dcbf43a1bd38ddfb0856ef642f49c18e3591cfcb09682f38f2fc54d07656
SHA512

d7919631e07c48494fdd1da94eaaf57572eabf62f5534f50de79f429c196acc68821e4d7a06054f281cd135210fc3bc0b1ee0a434a722384929e9741683a0214
SSDEEP

192:0spimZ41sBFGsZyNHE7JeINpgMe3+eks7QM90kTaxzrLvB1Sv/9OmG6mKkInFjp8:0ixZ4SG1tE78INWnfl9MFKZ8Inh2

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File created	C:\Windows\SysWOW64\mseion.sys	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2072	2996	rundll32.exe	28
PID 2996 wrote to memory of 2072	2996	rundll32.exe	28
PID 2996 wrote to memory of 2072	2996	rundll32.exe	28
PID 2996 wrote to memory of 2072	2996	rundll32.exe	28
PID 2996 wrote to memory of 2072	2996	rundll32.exe	28
PID 2996 wrote to memory of 2072	2996	rundll32.exe	28
PID 2996 wrote to memory of 2072	2996	rundll32.exe	28
PID 2072 wrote to memory of 1160	2072	rundll32.exe	21

memory/1160-5-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/2072-0-0x000000000F000000-0x000000000F019000-memory.dmp

Filesize
100KB

Download
memory/2072-1-0x000000000F011000-0x000000000F012000-memory.dmp

Filesize
4KB

Download