43bccff377dc67c75762c5ad39656273d56bd19504aabc1e6c78aa6c3d8f6efd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 01:37

Target

242f9416df8f44800caef137499908b0_JaffaCakes118.dll
Size

86KB
MD5

242f9416df8f44800caef137499908b0
SHA1

b11e9736807aaa395a2cd59d9eae9858ef62d556
SHA256

43bccff377dc67c75762c5ad39656273d56bd19504aabc1e6c78aa6c3d8f6efd
SHA512

415ed9a958d0019b9f33ea3e252955bc8aad6f6b24cd4943b0e8acbb83d363f376fe5d7a541da4501fa9ce5f19e37041ea63895cbb0b5c2673070fad1b8bb125
SSDEEP

1536:bq+dX5z9lhsRbarmsapZyWK+0IStWJ+xruajIDUsL+JjiHq0VaO1FsPRFDmu+TzE:bbdRhsRwmsmB4tCailUsLHq0VaODQcE

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1200	rundll32.exe
1200	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1200	532	rundll32.exe	81
PID 532 wrote to memory of 1200	532	rundll32.exe	81
PID 532 wrote to memory of 1200	532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\242f9416df8f44800caef137499908b0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\242f9416df8f44800caef137499908b0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1200

memory/1200-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1200-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/1200-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/1200-3-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download