87e8818487b0c33c1ae9715000a402f6030e63cf6766e75dc5afa11095a181a0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 07:49

Target

21975eefca2a5262147a9930f6156d2f_JaffaCakes118.dll
Size

632KB
MD5

21975eefca2a5262147a9930f6156d2f
SHA1

1e984f606532270fdbd170410825f1ef83b7edcb
SHA256

87e8818487b0c33c1ae9715000a402f6030e63cf6766e75dc5afa11095a181a0
SHA512

644edf6a694b65ee1b0a3eff2c5a89190a5ec495cb0b8e14f1345f3410a1be937066d586801da88e3fb6b40bda377046831abc8de66f684e8bd93193212abcdd
SSDEEP

6144:g8qjDPZt7R7hb4Jp3puOEiSBTsLPYZHcANGmHdrNTO0Lowb8EJVUv2SiD:g8aNztM73puzNOOlHTXowb8Q9

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 4508	1220	rundll32.exe	84
PID 1220 wrote to memory of 4508	1220	rundll32.exe	84
PID 1220 wrote to memory of 4508	1220	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21975eefca2a5262147a9930f6156d2f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21975eefca2a5262147a9930f6156d2f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4508