b82a2dbb8bc6359c6594b29a899ec3a23f3c9a5c605c91a5cb28747b75f60c20

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 05:57

Target

f2d5dc82ad36e11d501a874fba8569ee_JaffaCakes118.dll
Size

7KB
MD5

f2d5dc82ad36e11d501a874fba8569ee
SHA1

8cec6ff68873a80ef8a6f072342f6eca5effca9f
SHA256

b82a2dbb8bc6359c6594b29a899ec3a23f3c9a5c605c91a5cb28747b75f60c20
SHA512

4c3858b84cc4ede3f88d322e80f72795d731ff2c9e7230a2aab32513584efb5a6d1d5a8ab0928edc77a0c64aa35bd272852842a0ee5cd1255e4e51a69d5404df
SSDEEP

96:jOWtBb9DzeUkE5Go6ccayCbFlsKuiQ7nP2NfR3qaf9ioOJuWp:jOWtp9DwEc8pHL1uiYnKfj8ocu

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1320	4404	rundll32.exe	83
PID 4404 wrote to memory of 1320	4404	rundll32.exe	83
PID 4404 wrote to memory of 1320	4404	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2d5dc82ad36e11d501a874fba8569ee_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2d5dc82ad36e11d501a874fba8569ee_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1320