5102a1692568a09bcaaf1f4a13e5a6664a6c95dcbfd03001c5932dd61f5fc5a4

Analysis

max time kernel
79s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 03:27

Target

1483d57bdcd1bade9a04498ded96c294_JaffaCakes118.dll
Size

532KB
MD5

1483d57bdcd1bade9a04498ded96c294
SHA1

e85e4ceae1d046c5d7528190edf299b56d6cc5ec
SHA256

5102a1692568a09bcaaf1f4a13e5a6664a6c95dcbfd03001c5932dd61f5fc5a4
SHA512

71e6b1321bf9433a5e7eb268643fccd5957e41400b4c36d72e48083f6abb07f18a5b3d92a53b781d827b433d015eeb053782ae9bb2e22edf3d24025f994789f6
SSDEEP

12288:aWqlQq4cbT+6UdtZGw9td0E7fRrxcjIs0B4sWsa:TzzMTn+byEFtcjNtsq

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2408	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2408	1984	rundll32.exe	81
PID 1984 wrote to memory of 2408	1984	rundll32.exe	81
PID 1984 wrote to memory of 2408	1984	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1483d57bdcd1bade9a04498ded96c294_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1483d57bdcd1bade9a04498ded96c294_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2408