6473e794d740abed51c059d41aad9bb004d5f6bae7538439d4183ddf47e00187

Analysis

max time kernel
54s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 03:53

Target

06c2e64adc4ad552cc74dd15c3c57fb1_JaffaCakes118.dll
Size

21KB
MD5

06c2e64adc4ad552cc74dd15c3c57fb1
SHA1

5e9ae2ce7416edff7e7c9b644d8e79183cb646bd
SHA256

6473e794d740abed51c059d41aad9bb004d5f6bae7538439d4183ddf47e00187
SHA512

e56368c1da725ea117f45fee8479d78a6088d9be6315ea673b2720f64b645a0fcd3836b74615c211306e56324ece96e528451dd54de8f45b70761482e2984215
SSDEEP

384:2tVhNeikrspkyC4FeaCv6f+fGpB/yeF8m1kwpe18ORgHl+et7vvxlLk3WrfxpyW:2tEiqspM4DziGpB/yeFhkwpeqvF7Dkw

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1780	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1780	2688	rundll32.exe	85
PID 2688 wrote to memory of 1780	2688	rundll32.exe	85
PID 2688 wrote to memory of 1780	2688	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c2e64adc4ad552cc74dd15c3c57fb1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c2e64adc4ad552cc74dd15c3c57fb1_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1780

memory/1780-0-0x000000006CF30000-0x000000006CF40000-memory.dmp

Filesize
64KB

Download