7a7b381825941f1bb9a1d0418d2a568f460b461a1eecfe5473fb6e5468ae4354

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 21:24

Target

0f9470c8288d2704dc70ed888498d74f_JaffaCakes118.dll
Size

9KB
MD5

0f9470c8288d2704dc70ed888498d74f
SHA1

67f1d49b0ac830cb02180339623b6d0b8b50e0fa
SHA256

7a7b381825941f1bb9a1d0418d2a568f460b461a1eecfe5473fb6e5468ae4354
SHA512

823b8bc258bc4897f8bd56183848c5e3dd0e5d23275336bb3e848d5662d07414e39c7dcf8b94ba4eacd6bb3a5dc208c9508c6d7f2535440a8cdd2b544c77df43
SSDEEP

192:zuPX1TZmP3j49FeB1RXakl8+0OLivqun11giakgUw9p:JPj478aklB0D911vVy

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 2220 wrote to memory of 1200	2220	rundll32.exe	21

memory/1200-2-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2220-3-0x000000000F000000-0x000000000F014000-memory.dmp

Filesize
80KB

Download
memory/2220-4-0x000000000F00C000-0x000000000F00D000-memory.dmp

Filesize
4KB

Download