23940f66a64c4c0746a9945f4872f4ab1b9519746b3666168bdac4d28b5d5e0b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 22:06

Target

3227d180abf1cb779e9d44ae974597f0_JaffaCakes118.dll
Size

9KB
MD5

3227d180abf1cb779e9d44ae974597f0
SHA1

21e5ef4393399836531e29ab2222a6dd2da0c46a
SHA256

23940f66a64c4c0746a9945f4872f4ab1b9519746b3666168bdac4d28b5d5e0b
SHA512

4eb3f144f5d19b9e31dc47c6b80375f9550f10fc76c44642893ff10f6d04b23f49f042a994d1c2b3620aa197f0e93b8306386abcc1baad81e5a7185206b96ecd
SSDEEP

192:/Gg1mser84CgXrHUAyI0YtR/zaHZPf9VuiaInouk8kgUw6J:/Gg1msg8LKHByibz8tfbRo5b

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2352	2912	rundll32.exe	30
PID 2912 wrote to memory of 2352	2912	rundll32.exe	30
PID 2912 wrote to memory of 2352	2912	rundll32.exe	30
PID 2912 wrote to memory of 2352	2912	rundll32.exe	30
PID 2912 wrote to memory of 2352	2912	rundll32.exe	30
PID 2912 wrote to memory of 2352	2912	rundll32.exe	30
PID 2912 wrote to memory of 2352	2912	rundll32.exe	30
PID 2352 wrote to memory of 1196	2352	rundll32.exe	21

memory/1196-4-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/2352-3-0x000000000F00C000-0x000000000F00D000-memory.dmp

Filesize
4KB

Download
memory/2352-2-0x000000000F000000-0x000000000F014000-memory.dmp

Filesize
80KB

Download