217a4404fabc9af51970a7632c7389f6ebb707a8a8e2fff24c2f59edf4f5930b

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 16:16

Target

3114fee54cf746b9caf7d9cf64f9fd5a_JaffaCakes118.dll
Size

11KB
MD5

3114fee54cf746b9caf7d9cf64f9fd5a
SHA1

192919bbe90545b146498bf1a8e3c28089f29732
SHA256

217a4404fabc9af51970a7632c7389f6ebb707a8a8e2fff24c2f59edf4f5930b
SHA512

952185e05c6b7c1e9df35e59bcc8004ab167311ac13df5dfdfa4d4b32ebed3872a04fb7b3969f6c4c2bdd4dde2559200fb15162dae4378758742c0f8a5e414c4
SSDEEP

192:JULyy1iGkZmVM+iieNdB0vGms+g+ppTKXghidgys:JOiGELikSvGms+g+pighi2y

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2200	4512	rundll32.exe	81
PID 4512 wrote to memory of 2200	4512	rundll32.exe	81
PID 4512 wrote to memory of 2200	4512	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3114fee54cf746b9caf7d9cf64f9fd5a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3114fee54cf746b9caf7d9cf64f9fd5a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2200