4ac1e44879f2090fa3bb9cbc9e25fabc32976b4a36a733723c27a1468f619cdb

Analysis

max time kernel
41s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:57

Target

26126ed38a147535b13f8ea6d21882ff_JaffaCakes118.dll
Size

102KB
MD5

26126ed38a147535b13f8ea6d21882ff
SHA1

594fe5e151c440241a651a8891ea30163c53eeef
SHA256

4ac1e44879f2090fa3bb9cbc9e25fabc32976b4a36a733723c27a1468f619cdb
SHA512

14cbb04f61670143f1cb398840907ded5fa3619be6774eb66b5d5aa027f66ad5885d2e1c3eda4b9030f0bab8a79fc6577ed32aa8d464b2927d339ce47e9901f6
SSDEEP

1536:yDXY2p40zZHlqtya47JZxTVLZXgWX4laK8RvFC9mptd3II7515CzOUB/Aeg:yDTzzTk549lZXFXGIvFC9q3II75uNAB

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1000	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1000	792	rundll32.exe	81
PID 792 wrote to memory of 1000	792	rundll32.exe	81
PID 792 wrote to memory of 1000	792	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26126ed38a147535b13f8ea6d21882ff_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26126ed38a147535b13f8ea6d21882ff_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1000

memory/1000-2-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1000-3-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1000-1-0x0000000002460000-0x000000000257D000-memory.dmp

Filesize
1.1MB

Download
memory/1000-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1000-4-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1000-5-0x0000000002460000-0x000000000257D000-memory.dmp

Filesize
1.1MB

Download