29d18e802e8ee9ee9f7b032c8a5fcfee13c9becdeb3ccfeb2d3d72349e1f12ea

Analysis

max time kernel
125s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 21:51

Target

00b64630dd6a5cbc2130558ce150407f_JaffaCakes118.dll
Size

729KB
MD5

00b64630dd6a5cbc2130558ce150407f
SHA1

3f1ab094e7b86d1132ac8f56f1f7252457950c81
SHA256

29d18e802e8ee9ee9f7b032c8a5fcfee13c9becdeb3ccfeb2d3d72349e1f12ea
SHA512

472ccf3e12df22b73ec0a10fcfe1ed89a2a1a455b1ab343072edff4d71b27b4954690ffe470095e01e7e707c919d2f2a0304b2fd3972be0dbda0a374c2933bb0
SSDEEP

12288:8rTmshjCnd6ghPEsASHkg6d1jqV+nxkAqWAyOhWUp4pG2TnHNZF4PMi1R:cm1nMIshGkjTjqaKK+32zm0sR

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2312	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 2312	3640	rundll32.exe	89
PID 3640 wrote to memory of 2312	3640	rundll32.exe	89
PID 3640 wrote to memory of 2312	3640	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b64630dd6a5cbc2130558ce150407f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b64630dd6a5cbc2130558ce150407f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
1⤵
PID:3112