9810a2351ae290870ccbc1ae2139f9cb50bbf16b6aa077576faa8801b4561cfe

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 05:28

Target

213a0c68116286945147404d1849b66a_JaffaCakes118.dll
Size

86KB
MD5

213a0c68116286945147404d1849b66a
SHA1

b519449b3583a3dd4a8f49b99f3e63e71313c33b
SHA256

9810a2351ae290870ccbc1ae2139f9cb50bbf16b6aa077576faa8801b4561cfe
SHA512

94ab1a0ef6708681e065bdb2680462e899194c4b1f55733fecc7488f411ac82159e0b324684027e205866b988bf3ee2b90c130791f2bac061b461fe4392e1e19
SSDEEP

1536:RmAR+PaNvOB6YxBIVoMirGIQ7rpoDGXcKZHzaOi2DLdRlyx:RmA4POE3IUknZZHbd38

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3412	rundll32.exe
3412	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 3412	336	rundll32.exe	82
PID 336 wrote to memory of 3412	336	rundll32.exe	82
PID 336 wrote to memory of 3412	336	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\213a0c68116286945147404d1849b66a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\213a0c68116286945147404d1849b66a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3412

memory/3412-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3412-1-0x00000000009F0000-0x00000000009F5000-memory.dmp

Filesize
20KB

Download
memory/3412-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3412-3-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download