848480b93898cc0dfa416daa098c850d4d4de58543580fac2fcff30d6810488d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 03:29

Target

5a4ad01f77110b0c40881a02e7f4c1b4_JaffaCakes118.dll
Size

10KB
MD5

5a4ad01f77110b0c40881a02e7f4c1b4
SHA1

92781aa289db52a57df70f0d16ffc6f2baff4886
SHA256

848480b93898cc0dfa416daa098c850d4d4de58543580fac2fcff30d6810488d
SHA512

bac958f6db82098695c2ad0c9cfa5987c20a40819d58cac3fc447850b99f79fc1f9bfd8f6e24c4917409b1c9575a96bbc27f91f6f596ce98b31dac02ed8ee114
SSDEEP

192:CzMohL/k/oV6VWSAIj/+xKTww8I1GgXN9N3utGuUpeyCVfkgUw9jO:C/L8/oVNFIT+xKf1GaLlyql

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1564	2076	rundll32.exe	30
PID 2076 wrote to memory of 1564	2076	rundll32.exe	30
PID 2076 wrote to memory of 1564	2076	rundll32.exe	30
PID 2076 wrote to memory of 1564	2076	rundll32.exe	30
PID 2076 wrote to memory of 1564	2076	rundll32.exe	30
PID 2076 wrote to memory of 1564	2076	rundll32.exe	30
PID 2076 wrote to memory of 1564	2076	rundll32.exe	30
PID 1564 wrote to memory of 1192	1564	rundll32.exe	21

memory/1192-5-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1564-2-0x000000000F00D000-0x000000000F00E000-memory.dmp

Filesize
4KB

Download
memory/1564-1-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download
memory/1564-0-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download