7d0dcc8b1ccf6edb965fbce969731daf326b244564f431b87435aa2de0e5f05b

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:43

Target

332c7ba264c164cc0e3f5072e5613540_JaffaCakes118.dll
Size

305KB
MD5

332c7ba264c164cc0e3f5072e5613540
SHA1

e98991d41e4b6f8b1222841aec7ed8e263594e7b
SHA256

7d0dcc8b1ccf6edb965fbce969731daf326b244564f431b87435aa2de0e5f05b
SHA512

d624e6d81428497d91fa47448ba5a15072db7c43bcdbf6b2f3ed53a267a2727a163179373af46adf21bb7b3cd105cf59c6c9ba981a4ad0684ecbac0e8dd9c363
SSDEEP

6144:NDBh7B0pHTah4lz2CZ9v+Zbj4F81U2e97Zq9FprzLIqKjs9QG:8uqlaa2ZA8de9FkDIqmG

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3760	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3760	4592	rundll32.exe	81
PID 4592 wrote to memory of 3760	4592	rundll32.exe	81
PID 4592 wrote to memory of 3760	4592	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\332c7ba264c164cc0e3f5072e5613540_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\332c7ba264c164cc0e3f5072e5613540_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3760

memory/3760-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/3760-1-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download