00905d9812cb4d1429e4249d2c4d06c34bda21d7f07b4bfe5dc6300a8e940e98

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 19:57

Target

36290ea48b41ed274df1681fea76e235_JaffaCakes118.dll
Size

51KB
MD5

36290ea48b41ed274df1681fea76e235
SHA1

bf5b57446d3153cccc3be3283203a7ea9fa1d6da
SHA256

00905d9812cb4d1429e4249d2c4d06c34bda21d7f07b4bfe5dc6300a8e940e98
SHA512

4a4eab1d911b4e4817d5758ec28abd6cc156581fac58fb7922bc6419d073187a89665e93d8a185fed67cacca736869c347717e93cd82bf852ae27279a4e898df
SSDEEP

768:DYpcv62CBu2QYqtsLXFeu7cj3CWLlIWyBfeUfiNA2jU9WELN:D22CBuBtsbFx7cjxRIWyBfjfiN/I9WE

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\huhudafe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\fotelodo	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
864	rundll32.exe
864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 864	4572	rundll32.exe	83
PID 4572 wrote to memory of 864	4572	rundll32.exe	83
PID 4572 wrote to memory of 864	4572	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36290ea48b41ed274df1681fea76e235_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36290ea48b41ed274df1681fea76e235_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:864

memory/864-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/864-1-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/864-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/864-3-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download