fede02b6d6da93e774734573b5887607d6c76154c6db44811d3f4b762329afa0

Analysis

max time kernel
140s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 04:50

Target

2f09e4884e2b55f75adbc775881a410c_JaffaCakes118.dll
Size

81KB
MD5

2f09e4884e2b55f75adbc775881a410c
SHA1

8e4dc59e8ecfa01d43f0722837e2a688581c148f
SHA256

fede02b6d6da93e774734573b5887607d6c76154c6db44811d3f4b762329afa0
SHA512

dd04d57708719d09569d1d2e97c81c6455b52588c59f730bd74fa4f83fba145549baa2f3f7662aa86454e9df97ef6ce8d9d6b88f884fdaf3041ea93a0a0d0e98
SSDEEP

1536:7B3gK9Xo7SAqKvSWEAd6B1G7ra8AAJipEMkLgwnu057T52t/8SM0:m6o9qKK1+6B1GxAZpsEGPxd50

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
376	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 376	5104	rundll32.exe	82
PID 5104 wrote to memory of 376	5104	rundll32.exe	82
PID 5104 wrote to memory of 376	5104	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f09e4884e2b55f75adbc775881a410c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f09e4884e2b55f75adbc775881a410c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:376

memory/376-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/376-1-0x0000000000B50000-0x0000000000B5F000-memory.dmp

Filesize
60KB

Download
memory/376-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/376-2-0x0000000010008000-0x0000000010017000-memory.dmp

Filesize
60KB

Download
memory/376-4-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download