75c0298c014d1b76f199deb8de8468b1122b2af84f934e75aefe62e57ed0b5db

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 18:07

Target

0880644a0aeda50c5f132230282601cb_JaffaCakes118.dll
Size

11KB
MD5

0880644a0aeda50c5f132230282601cb
SHA1

00eeea85cef7aa779a4584714ba4f2a6c450e10c
SHA256

75c0298c014d1b76f199deb8de8468b1122b2af84f934e75aefe62e57ed0b5db
SHA512

7376671e75799a8ba81be815d5f95502c4557f37eeff74b238c0adf5e5fc050a557c59926d73a6994b1ade5aa66dfcfd875a032ba85491ed2aa61aeb530b87bf
SSDEEP

192:nqwJiOQ89r0H117+2idOd9jA7V5th+JWaZg:Z4O5p0mo9jA728+g

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1756	4412	rundll32.exe	91
PID 4412 wrote to memory of 1756	4412	rundll32.exe	91
PID 4412 wrote to memory of 1756	4412	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0880644a0aeda50c5f132230282601cb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0880644a0aeda50c5f132230282601cb_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3280

memory/1756-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download