4551af8861177feb48b695460ac6030056319812dd15b34038a9a29f772f30e4

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 18:15

Target

31722bf4b8e565be1929416fc61994cb_JaffaCakes118.dll
Size

57KB
MD5

31722bf4b8e565be1929416fc61994cb
SHA1

c8c744e8d55a6b22bed539b20da9c4cbc4867910
SHA256

4551af8861177feb48b695460ac6030056319812dd15b34038a9a29f772f30e4
SHA512

ceb1ff2c7781eab448dd5e8ebfb5d5c81f441a08b2375100b839e426614257e252cda040943d1bdab827649fcdb8b1b61737b8b48ce90f3841a4cae5abddad6a
SSDEEP

768:qQJvznJcPRIjFkcENDgeHtY5pc/76paw7Fzwz+RriTIc:qSvznuPRIjFqacep97VGWr2Ic

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4172	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4172	4040	rundll32.exe	83
PID 4040 wrote to memory of 4172	4040	rundll32.exe	83
PID 4040 wrote to memory of 4172	4040	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31722bf4b8e565be1929416fc61994cb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31722bf4b8e565be1929416fc61994cb_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4172

memory/4172-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download