0adb76509e293c2230ea4d9889258bed689ce61834de3450f2ed886d4d53506d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 19:25

Target

4b12cd4da020be5d945c9bc9a508969e_JaffaCakes118.dll
Size

17KB
MD5

4b12cd4da020be5d945c9bc9a508969e
SHA1

356df58fff57f286450961f15d00d5b9e4366216
SHA256

0adb76509e293c2230ea4d9889258bed689ce61834de3450f2ed886d4d53506d
SHA512

349116d3239d83536d40b314de86cd7f27a71e03c01300abd098298e481ec1dcf6102c0d6e4a819d7c431c1ed637c5af5a9d13530cede448692bd675b894237e
SSDEEP

384:5nnTcuRsgrH4NiHJ4akzXYZzay4a4ww0DDSf1:5nDKgrHuGCXO7V4ww0vE1

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mseion.sys	rundll32.exe
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2996	2956	rundll32.exe	31
PID 2956 wrote to memory of 2996	2956	rundll32.exe	31
PID 2956 wrote to memory of 2996	2956	rundll32.exe	31
PID 2956 wrote to memory of 2996	2956	rundll32.exe	31
PID 2956 wrote to memory of 2996	2956	rundll32.exe	31
PID 2956 wrote to memory of 2996	2956	rundll32.exe	31
PID 2956 wrote to memory of 2996	2956	rundll32.exe	31
PID 2996 wrote to memory of 1192	2996	rundll32.exe	21

memory/1192-6-0x0000000002D00000-0x0000000002D01000-memory.dmp

Filesize
4KB

Download
memory/2996-2-0x000000000F014000-0x000000000F015000-memory.dmp

Filesize
4KB

Download
memory/2996-1-0x000000000F000000-0x000000000F01C000-memory.dmp

Filesize
112KB

Download
memory/2996-0-0x000000000F000000-0x000000000F01C000-memory.dmp

Filesize
112KB

Download