85b8d1909724566b93f1763429e7c92b8ebad1be7e87c19b8505b0d215a4dacb

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 00:46

Target

f4b015a0205b5ac7275098b97bbefb10_JaffaCakes118.dll
Size

48KB
MD5

f4b015a0205b5ac7275098b97bbefb10
SHA1

c4539054c5175785241cdaa08e3d67b18011bef1
SHA256

85b8d1909724566b93f1763429e7c92b8ebad1be7e87c19b8505b0d215a4dacb
SHA512

08ab78d7deac3694bb11df509be4b7cb2024d7cfe20a02951cb12c500347e8ceb0334c7854faad925eede3114f179db5fbdd4d5d5efedf0c5f89572531487cff
SSDEEP

768:q7fy45WBekbfHhemw0NKbLty68OIIJdtzFsII7tIVJD:q7x5xkbfB80NKbLAJS/FIiV

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
892	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 892	960	rundll32.exe	82
PID 960 wrote to memory of 892	960	rundll32.exe	82
PID 960 wrote to memory of 892	960	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b015a0205b5ac7275098b97bbefb10_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b015a0205b5ac7275098b97bbefb10_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:892