50c0311db5e4f587cb5b5a041ee44b93f30cec6c836cd7cf0a5efe066e6181d8

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 17:01

Target

2d2001f21ee3d42bf093bc9ac0195e22_JaffaCakes118.dll
Size

318KB
MD5

2d2001f21ee3d42bf093bc9ac0195e22
SHA1

8d9f3b1d92afd5b09d6ebbe20680adbbebd3daf4
SHA256

50c0311db5e4f587cb5b5a041ee44b93f30cec6c836cd7cf0a5efe066e6181d8
SHA512

bfdba70b1c57cc6068010037145fd756d15d0e4eaeccaf7bf1f066c00642658b8b7363fc1c4a4149f04e292a59cf9e55fe8206e0c8367fdc5cad4eb13f2d636e
SSDEEP

6144:mvDDHy5z2wg9btsWXxntETMF4efN3VnlfxG4x+7UX9lwdpPbkg8TF+8g:GDS5zng5+8n8vMVlZF+7UTUTkg8R+8g

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 5100	3668	rundll32.exe	82
PID 3668 wrote to memory of 5100	3668	rundll32.exe	82
PID 3668 wrote to memory of 5100	3668	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2001f21ee3d42bf093bc9ac0195e22_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2001f21ee3d42bf093bc9ac0195e22_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5100

memory/5100-0-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download