6033322a9da7db8282cd9602bd1aee1ca8f5cdc2ce0afecc0222849ce6793c87

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 00:26

Target

32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll
Size

307KB
MD5

32990fc7ef82f24a56dc0d263618a102
SHA1

9748866ba26d76d11cb46667fb4fcf84d770bf3c
SHA256

6033322a9da7db8282cd9602bd1aee1ca8f5cdc2ce0afecc0222849ce6793c87
SHA512

f444e037b82c123efb6da3f42b7537993cb5485d3c031c23cb06120d78b81420c4ad85d9c5a52a513e5f50ffbd18117ce8eb01dea1dbc4895bea28fba3258049
SSDEEP

6144:m+FLMJGJnjOy5HIY74Socz7uH2KnFYZYY40+aLXRvl2OhpbifnZglGi:maLMaOy5oY7LlziH2zm0R5gOh5YZgz

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4552	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4552	3136	rundll32.exe	81
PID 3136 wrote to memory of 4552	3136	rundll32.exe	81
PID 3136 wrote to memory of 4552	3136	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4552

memory/4552-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/4552-1-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download