12f28f1e224bd47e2254f3aa5ba3cd0c9944675333cbc29f388aecd6913d2a85

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 09:52

Target

158ec7635cd915b778f3a38de6e8a572_JaffaCakes118.dll
Size

13KB
MD5

158ec7635cd915b778f3a38de6e8a572
SHA1

fdd24b66ed430ece060fc4d34cd78d8ae3ecdb53
SHA256

12f28f1e224bd47e2254f3aa5ba3cd0c9944675333cbc29f388aecd6913d2a85
SHA512

4c623b3487c0f752c3e79272f52c3f85e0412b3633c1a4b7ecf053da506eeba0e8b7dc45fc5daf9a977c3828a45310ac9698af3f5c3e69d69cf274da31122518
SSDEEP

384:KDj22Ox/fmgOzPrDyMjZk6X2X/RZ+rnsIBA:g22A+gYXXjZL+KZe

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2096 wrote to memory of 1188	2096	rundll32.exe	21

memory/1188-4-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2096-0-0x000000000F000000-0x000000000F01B000-memory.dmp

Filesize
108KB

Download
memory/2096-1-0x000000000F013000-0x000000000F014000-memory.dmp

Filesize
4KB

Download