5fc7b0312023cd2c1c8b119e902640b93c385ebf46b5bb36d85a57a262f15be6

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 22:11

Target

239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll
Size

307KB
MD5

239bfbb6dea7eb37e208333548fe028b
SHA1

a4dace9c0e92f4d93330f3b73fb00f750138325a
SHA256

5fc7b0312023cd2c1c8b119e902640b93c385ebf46b5bb36d85a57a262f15be6
SHA512

9509f42b34e86cdf140e0e2b181050c23ab455a46802ca9341a729dcd443962d46cccb8587398a248bbbdabca9534dd961344d12fb2992d9c4a8e431281e7d20
SSDEEP

6144:c88Duu0EIX4n+QR57+CJ9sUnSDxMCW+jQoC2m4JQREa+HD42RASo5D:38RrGkC6CmRPH2Qcc2R+D

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1704	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1704	1680	rundll32.exe	28
PID 1680 wrote to memory of 1704	1680	rundll32.exe	28
PID 1680 wrote to memory of 1704	1680	rundll32.exe	28
PID 1680 wrote to memory of 1704	1680	rundll32.exe	28
PID 1680 wrote to memory of 1704	1680	rundll32.exe	28
PID 1680 wrote to memory of 1704	1680	rundll32.exe	28
PID 1680 wrote to memory of 1704	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1704

memory/1704-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/1704-1-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download