bece80345329afeb05be3e40dafb1073156bd8ba61818ac1de2d1549934a6486

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 23:07

Target

ec2f563890021be0ac63d617e94f263d_JaffaCakes118.dll
Size

882KB
MD5

ec2f563890021be0ac63d617e94f263d
SHA1

8e2d16ec2d2c62844c39494848c090d839e483cd
SHA256

bece80345329afeb05be3e40dafb1073156bd8ba61818ac1de2d1549934a6486
SHA512

c23234002c9875686ad88763791dadf69ec3b307cae06214c291480d85f5536a14996456704847ff97520dcdb46a38761979657d4b07f2d966a41bb4815629c6
SSDEEP

24576:lpZsh9hvaUtY+K5PwE9v4w0zO20ActTpcCmILYKV+u9O4f:KhW825PlJ0TJcttcCmIf+u9Z

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1196	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1196	2320	rundll32.exe	28
PID 2320 wrote to memory of 1196	2320	rundll32.exe	28
PID 2320 wrote to memory of 1196	2320	rundll32.exe	28
PID 2320 wrote to memory of 1196	2320	rundll32.exe	28
PID 2320 wrote to memory of 1196	2320	rundll32.exe	28
PID 2320 wrote to memory of 1196	2320	rundll32.exe	28
PID 2320 wrote to memory of 1196	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec2f563890021be0ac63d617e94f263d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec2f563890021be0ac63d617e94f263d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1196