1c84a5afb02cb075b1de9fd301c677704e972a2fc3a6fa3fcb2f8ee71f92d235

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 17:54

Target

09f8558b05714db821621c87047ac396_JaffaCakes118.dll
Size

281KB
MD5

09f8558b05714db821621c87047ac396
SHA1

0ae6f1dfe3174f51edabca0ab18272a4da732a03
SHA256

1c84a5afb02cb075b1de9fd301c677704e972a2fc3a6fa3fcb2f8ee71f92d235
SHA512

ef82d6f931cbfd7ffa37efb24399c18acb5f4b41e77d9d97d8f5d6bfe7539e34ce52d03d86a37efb34d82a33a4c235690d90ae7034592e09b1d7a47340dbfe0f
SSDEEP

6144:WOsT5/b1q9HkRWk3XeSQ5SxrrzRlxQg3Pb4bV7olDnRly:yloERWknDkEXzXmgkbV7Yn

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2244	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2244	2468	rundll32.exe	28
PID 2468 wrote to memory of 2244	2468	rundll32.exe	28
PID 2468 wrote to memory of 2244	2468	rundll32.exe	28
PID 2468 wrote to memory of 2244	2468	rundll32.exe	28
PID 2468 wrote to memory of 2244	2468	rundll32.exe	28
PID 2468 wrote to memory of 2244	2468	rundll32.exe	28
PID 2468 wrote to memory of 2244	2468	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09f8558b05714db821621c87047ac396_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09f8558b05714db821621c87047ac396_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2244

memory/2244-0-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download
memory/2244-1-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download
memory/2244-4-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/2244-3-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download
memory/2244-2-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download