96569e7ca939c82977466a5f5785f68816e031289c34127412aaa59c08c2caad

Analysis

max time kernel
53s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 21:25

Target

1c8cdf4ae394875f8276393208c8bfc8_JaffaCakes118.dll
Size

5KB
MD5

1c8cdf4ae394875f8276393208c8bfc8
SHA1

d25a77fa4b2fdbcc091a4640075f113dfdecb128
SHA256

96569e7ca939c82977466a5f5785f68816e031289c34127412aaa59c08c2caad
SHA512

2b7fe29243f290851832dc6f505cb48d90a9ccf4c20eba183936f1a3612106a98aee0a068b2b901cd404180e007bc5c02bc4bfaac08ace2aa095a279afe9c6f4
SSDEEP

48:Cr/I2/LT2OfIkQl/7MTjfPK6bDS1u2It7KuDXdS6uDX3TIOVanfQTc0L+9+dc:EW7/7mjdbuc2S7hTMRT31afobW

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4152	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4152	3300	rundll32.exe	80
PID 3300 wrote to memory of 4152	3300	rundll32.exe	80
PID 3300 wrote to memory of 4152	3300	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c8cdf4ae394875f8276393208c8bfc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c8cdf4ae394875f8276393208c8bfc8_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4152