6473e794d740abed51c059d41aad9bb004d5f6bae7538439d4183ddf47e00187

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 03:53

Target

06c2e64adc4ad552cc74dd15c3c57fb1_JaffaCakes118.dll
Size

21KB
MD5

06c2e64adc4ad552cc74dd15c3c57fb1
SHA1

5e9ae2ce7416edff7e7c9b644d8e79183cb646bd
SHA256

6473e794d740abed51c059d41aad9bb004d5f6bae7538439d4183ddf47e00187
SHA512

e56368c1da725ea117f45fee8479d78a6088d9be6315ea673b2720f64b645a0fcd3836b74615c211306e56324ece96e528451dd54de8f45b70761482e2984215
SSDEEP

384:2tVhNeikrspkyC4FeaCv6f+fGpB/yeF8m1kwpe18ORgHl+et7vvxlLk3WrfxpyW:2tEiqspM4DziGpB/yeFhkwpeqvF7Dkw

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2168	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2168	1692	rundll32.exe	28
PID 1692 wrote to memory of 2168	1692	rundll32.exe	28
PID 1692 wrote to memory of 2168	1692	rundll32.exe	28
PID 1692 wrote to memory of 2168	1692	rundll32.exe	28
PID 1692 wrote to memory of 2168	1692	rundll32.exe	28
PID 1692 wrote to memory of 2168	1692	rundll32.exe	28
PID 1692 wrote to memory of 2168	1692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c2e64adc4ad552cc74dd15c3c57fb1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c2e64adc4ad552cc74dd15c3c57fb1_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2168

memory/2168-1-0x000000006CF30000-0x000000006CF40000-memory.dmp

Filesize
64KB

Download
memory/2168-0-0x000000006CF30000-0x000000006CF40000-memory.dmp

Filesize
64KB

Download