4cc9704a7bc59dbc3998271469f71d9b4b8063fc295801afbb9c869413b3edc0

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 20:52

Target

00718105c4cb3307f9c2d462c3262045_JaffaCakes118.dll
Size

25KB
MD5

00718105c4cb3307f9c2d462c3262045
SHA1

13d7e386812c11bda7fab887f581d93d5f67087f
SHA256

4cc9704a7bc59dbc3998271469f71d9b4b8063fc295801afbb9c869413b3edc0
SHA512

f9460b42a9d1d6710b1bf2ed405d002e337ab70e8d359904357170d2bd705e54084f9b9ac42c3be8cc709a609bb557ce1dddac33c1802d5765d2630a98c33ee7
SSDEEP

384:wNtlWuUEr9wUUnAh6J+hVz3FmD8A+C5hOn7MoESIPaWFnBWTbB:+lWu+kh60hVz3wDA2U7uzPpBe

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2320	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2320	2700	rundll32.exe	28
PID 2700 wrote to memory of 2320	2700	rundll32.exe	28
PID 2700 wrote to memory of 2320	2700	rundll32.exe	28
PID 2700 wrote to memory of 2320	2700	rundll32.exe	28
PID 2700 wrote to memory of 2320	2700	rundll32.exe	28
PID 2700 wrote to memory of 2320	2700	rundll32.exe	28
PID 2700 wrote to memory of 2320	2700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00718105c4cb3307f9c2d462c3262045_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00718105c4cb3307f9c2d462c3262045_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2320