4551af8861177feb48b695460ac6030056319812dd15b34038a9a29f772f30e4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 18:15

Target

31722bf4b8e565be1929416fc61994cb_JaffaCakes118.dll
Size

57KB
MD5

31722bf4b8e565be1929416fc61994cb
SHA1

c8c744e8d55a6b22bed539b20da9c4cbc4867910
SHA256

4551af8861177feb48b695460ac6030056319812dd15b34038a9a29f772f30e4
SHA512

ceb1ff2c7781eab448dd5e8ebfb5d5c81f441a08b2375100b839e426614257e252cda040943d1bdab827649fcdb8b1b61737b8b48ce90f3841a4cae5abddad6a
SSDEEP

768:qQJvznJcPRIjFkcENDgeHtY5pc/76paw7Fzwz+RriTIc:qSvznuPRIjFqacep97VGWr2Ic

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2016	1748	rundll32.exe	30
PID 1748 wrote to memory of 2016	1748	rundll32.exe	30
PID 1748 wrote to memory of 2016	1748	rundll32.exe	30
PID 1748 wrote to memory of 2016	1748	rundll32.exe	30
PID 1748 wrote to memory of 2016	1748	rundll32.exe	30
PID 1748 wrote to memory of 2016	1748	rundll32.exe	30
PID 1748 wrote to memory of 2016	1748	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31722bf4b8e565be1929416fc61994cb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31722bf4b8e565be1929416fc61994cb_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2016

memory/2016-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2016-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2016-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2016-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download