5e6f65044ef20955db29c056631cca0789e38383ec2d1d2da36b64118415f493

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 23:43

Target

0ff70c32ef64f8cb7a23518d40cfbfdc_JaffaCakes118.dll
Size

25KB
MD5

0ff70c32ef64f8cb7a23518d40cfbfdc
SHA1

6debe009e01733d4bb716b2149fd6de76814742f
SHA256

5e6f65044ef20955db29c056631cca0789e38383ec2d1d2da36b64118415f493
SHA512

b6bf99906183a649b21f26de4e69e9346480c0c85bfafef5b3423e758937076db4e54f2bd73525e7dee2c1969fd780c292d496d3f232dd68bed6c039f1a1d8cd
SSDEEP

384:wNtlWuUEr9wUUnAh6J+hVz3FmD8A+C5hOn7MoESIPaWFnBWTbB9:+lWu+kh60hVz3wDA2U7uzPpBe9

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4248	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4248	2816	rundll32.exe	83
PID 2816 wrote to memory of 4248	2816	rundll32.exe	83
PID 2816 wrote to memory of 4248	2816	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff70c32ef64f8cb7a23518d40cfbfdc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff70c32ef64f8cb7a23518d40cfbfdc_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4248