36e5573073dcf967a055de1edd4a3fdec0f94f4a9a59aafa0435544408941acf

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:01

Target

5b15a983186c43c30d6e6978dc7d2ec4_JaffaCakes118.dll
Size

10KB
MD5

5b15a983186c43c30d6e6978dc7d2ec4
SHA1

a6d25ec4a381952134f98910ff6d6df33416de08
SHA256

36e5573073dcf967a055de1edd4a3fdec0f94f4a9a59aafa0435544408941acf
SHA512

360ab80c8b847d7afaaa42e262679d172cea96b6233917ece3e0adc42c6023e44e7da34cce1f9467cb5eb09dd5d8f5096de6b14dd93f37333aa58cc97e040080
SSDEEP

192:liEeZyGhw0S447tjQUhabZXrvjZE50LJXNA8sdsXC1gqRmnZcDm5d0whkgUw9H:q3VAtjQAabZTjZEowKX6gqMk+dtus

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2064	2268	rundll32.exe	30
PID 2268 wrote to memory of 2064	2268	rundll32.exe	30
PID 2268 wrote to memory of 2064	2268	rundll32.exe	30
PID 2268 wrote to memory of 2064	2268	rundll32.exe	30
PID 2268 wrote to memory of 2064	2268	rundll32.exe	30
PID 2268 wrote to memory of 2064	2268	rundll32.exe	30
PID 2268 wrote to memory of 2064	2268	rundll32.exe	30
PID 2064 wrote to memory of 1184	2064	rundll32.exe	21

memory/1184-2-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2064-5-0x000000000F00C000-0x000000000F00D000-memory.dmp

Filesize
4KB

Download
memory/2064-4-0x000000000F000000-0x000000000F014000-memory.dmp

Filesize
80KB

Download