270d77eb9323116c897b7bfc696cb38a7c36ed8cdfa3f8d85d54bc88b17d554b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 10:11

Target

258f6207e664496f47b43fdf4143e330_JaffaCakes118.dll
Size

307KB
MD5

258f6207e664496f47b43fdf4143e330
SHA1

137e3c5c134c99ee8e3d3fc419e9d35a44f75f37
SHA256

270d77eb9323116c897b7bfc696cb38a7c36ed8cdfa3f8d85d54bc88b17d554b
SHA512

1cb04761a880755216af76f17c0362bc826d91bd82ffc0e540d86a9f5a18b071b8e635a47643a99c0a34a1694846799d806e664a9ad129e28e2531076def974e
SSDEEP

6144:BNLn4C5BZpFw2HHEjxqzR8IVm336knfTJrFXr0/EkMgO/mkCRU:PzlFFEYLVmHF1Z0/Cmw

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2752	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2752	2844	rundll32.exe	28
PID 2844 wrote to memory of 2752	2844	rundll32.exe	28
PID 2844 wrote to memory of 2752	2844	rundll32.exe	28
PID 2844 wrote to memory of 2752	2844	rundll32.exe	28
PID 2844 wrote to memory of 2752	2844	rundll32.exe	28
PID 2844 wrote to memory of 2752	2844	rundll32.exe	28
PID 2844 wrote to memory of 2752	2844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\258f6207e664496f47b43fdf4143e330_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\258f6207e664496f47b43fdf4143e330_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2752

memory/2752-0-0x000000001009D000-0x000000001009E000-memory.dmp

Filesize
4KB

Download
memory/2752-1-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download