5c4d5d9ef4fb5f630ec7987caccab2954cbebbb100ab0a64c5db83f5c65750c5

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 13:30

Target

41df7434bbd4f4b5277de8d7defcb1c6_JaffaCakes118.dll
Size

24KB
MD5

41df7434bbd4f4b5277de8d7defcb1c6
SHA1

0309dded791faa4a94bd23a5b5e8bc618c064c78
SHA256

5c4d5d9ef4fb5f630ec7987caccab2954cbebbb100ab0a64c5db83f5c65750c5
SHA512

0dc272fb1f200a216689a1874c2b64890e61abb80ea568b8d279b72416982dce8416b3f238e84e364afec14d4b8362c2f5371e5933600c146aa08f1eb31f7f75
SSDEEP

384:9JUhZXJPSpslKbXr55rbKP/xPq/hc9ZYAbw1cZPq160:9qh3PSpaAXr55rbKPunAbWcZC16

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1412	1908	rundll32.exe	31
PID 1908 wrote to memory of 1412	1908	rundll32.exe	31
PID 1908 wrote to memory of 1412	1908	rundll32.exe	31
PID 1908 wrote to memory of 1412	1908	rundll32.exe	31
PID 1908 wrote to memory of 1412	1908	rundll32.exe	31
PID 1908 wrote to memory of 1412	1908	rundll32.exe	31
PID 1908 wrote to memory of 1412	1908	rundll32.exe	31
PID 1412 wrote to memory of 1360	1412	rundll32.exe	21

memory/1360-3-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download