5308e1abfb01f4353b32403cb2c7f89116c42b19d0edfd27e426ee3cc56c317f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 11:49

Target

2c3afc5b3c3a54290c478f645fd90364_JaffaCakes118.dll
Size

25KB
MD5

2c3afc5b3c3a54290c478f645fd90364
SHA1

76960938b392dbbbcb405a141367e7196dff09db
SHA256

5308e1abfb01f4353b32403cb2c7f89116c42b19d0edfd27e426ee3cc56c317f
SHA512

d579cdee22134e756a52f4e03b24825e41b4c697b26d12fd3483e9e130ab3b31a3fe6bf94e32aaf01f7e74fe0488c5fa460d3e0c392189fa954040ac45cdc8fa
SSDEEP

384:EW5/p9P4FLcryiy2emca/QzFvdDh67OD7NFTLFIVDcW6GGKHBWYZyCYyk:EW5/pR4Sr5caIhvdDQ2QDn6cBtZS

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3016	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 3016	1996	rundll32.exe	82
PID 1996 wrote to memory of 3016	1996	rundll32.exe	82
PID 1996 wrote to memory of 3016	1996	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c3afc5b3c3a54290c478f645fd90364_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c3afc5b3c3a54290c478f645fd90364_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3016