ad0b0695c45508b587deb06743c593142ec54372c699e4cb88129c88e51c0b8c

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 16:29

Target

0ec0f7f3be946ac1721ae7a6725d0784_JaffaCakes118.dll
Size

65KB
MD5

0ec0f7f3be946ac1721ae7a6725d0784
SHA1

179acc4a03ee0aaf4b9c3a954f3ccb63748f365c
SHA256

ad0b0695c45508b587deb06743c593142ec54372c699e4cb88129c88e51c0b8c
SHA512

d5735342c72ec3420e62570591609c1b3b3a3254e7f73a76e39a6bd78f8da018eaa3c17f4f3a8de237d4c757c706ae905c2db65c58479d88e4402974e7062c5d
SSDEEP

1536:YSls8NaW57/9mzY4WC1c+NrD84rmE4CjbpEBbECw:FRIw/ZC1c+NrV94sb2BbECw

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 5016	3304	rundll32.exe	92
PID 3304 wrote to memory of 5016	3304	rundll32.exe	92
PID 3304 wrote to memory of 5016	3304	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec0f7f3be946ac1721ae7a6725d0784_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec0f7f3be946ac1721ae7a6725d0784_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4104

memory/5016-0-0x0000000000890000-0x000000000091C000-memory.dmp

Filesize
560KB

Download
memory/5016-2-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/5016-1-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/5016-3-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/5016-4-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download