856e992ed65b9e4dce62d48acc0c22ed008186d593190d772d2256e56f2789ab

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 14:13

Target

1a6eb84c4ad1a45ac391573e79cc792b_JaffaCakes118.dll
Size

86KB
MD5

1a6eb84c4ad1a45ac391573e79cc792b
SHA1

06af4693f989754f3f9246bd7cca53a510186e4f
SHA256

856e992ed65b9e4dce62d48acc0c22ed008186d593190d772d2256e56f2789ab
SHA512

c518d7bc0a5e9fe8adde910c5da22cdc584f2651e5b24b06f3a38274f372732ff6c0b8aed716ceb76550631efbdc39a2a0f80c0c2576b1afcc46973d81b64136
SSDEEP

1536:2Apeoasrb7hz8W9Mod5ekuvn+3HVKj18sFwH17zn9ei7bTEqYco1nRBQcK:2Ivas/lg1v+38jmOkzQqTZYctZ

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3312	rundll32.exe
3312	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3312	4896	rundll32.exe	81
PID 4896 wrote to memory of 3312	4896	rundll32.exe	81
PID 4896 wrote to memory of 3312	4896	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a6eb84c4ad1a45ac391573e79cc792b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a6eb84c4ad1a45ac391573e79cc792b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3312

memory/3312-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3312-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3312-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3312-3-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download