5fc7b0312023cd2c1c8b119e902640b93c385ebf46b5bb36d85a57a262f15be6

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 22:11

Target

239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll
Size

307KB
MD5

239bfbb6dea7eb37e208333548fe028b
SHA1

a4dace9c0e92f4d93330f3b73fb00f750138325a
SHA256

5fc7b0312023cd2c1c8b119e902640b93c385ebf46b5bb36d85a57a262f15be6
SHA512

9509f42b34e86cdf140e0e2b181050c23ab455a46802ca9341a729dcd443962d46cccb8587398a248bbbdabca9534dd961344d12fb2992d9c4a8e431281e7d20
SSDEEP

6144:c88Duu0EIX4n+QR57+CJ9sUnSDxMCW+jQoC2m4JQREa+HD42RASo5D:38RrGkC6CmRPH2Qcc2R+D

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1136	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1136	2740	rundll32.exe	81
PID 2740 wrote to memory of 1136	2740	rundll32.exe	81
PID 2740 wrote to memory of 1136	2740	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1136

memory/1136-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/1136-1-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download