ad0b0695c45508b587deb06743c593142ec54372c699e4cb88129c88e51c0b8c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:29

Target

0ec0f7f3be946ac1721ae7a6725d0784_JaffaCakes118.dll
Size

65KB
MD5

0ec0f7f3be946ac1721ae7a6725d0784
SHA1

179acc4a03ee0aaf4b9c3a954f3ccb63748f365c
SHA256

ad0b0695c45508b587deb06743c593142ec54372c699e4cb88129c88e51c0b8c
SHA512

d5735342c72ec3420e62570591609c1b3b3a3254e7f73a76e39a6bd78f8da018eaa3c17f4f3a8de237d4c757c706ae905c2db65c58479d88e4402974e7062c5d
SSDEEP

1536:YSls8NaW57/9mzY4WC1c+NrD84rmE4CjbpEBbECw:FRIw/ZC1c+NrV94sb2BbECw

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2208	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2208	1668	rundll32.exe	28
PID 1668 wrote to memory of 2208	1668	rundll32.exe	28
PID 1668 wrote to memory of 2208	1668	rundll32.exe	28
PID 1668 wrote to memory of 2208	1668	rundll32.exe	28
PID 1668 wrote to memory of 2208	1668	rundll32.exe	28
PID 1668 wrote to memory of 2208	1668	rundll32.exe	28
PID 1668 wrote to memory of 2208	1668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec0f7f3be946ac1721ae7a6725d0784_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec0f7f3be946ac1721ae7a6725d0784_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2208

memory/2208-1-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2208-2-0x0000000000170000-0x00000000001FC000-memory.dmp

Filesize
560KB

Download
memory/2208-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2208-3-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download