d943a9cb72bede506dca958482a1736de47b57ee578efa4223853ea0a535564b

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 22:55

Target

3b0aafc1c15ca0e24ad6eb1d5f195b65_JaffaCakes118.dll
Size

86KB
MD5

3b0aafc1c15ca0e24ad6eb1d5f195b65
SHA1

f296138beb90eb0213d46022cd266472045d159d
SHA256

d943a9cb72bede506dca958482a1736de47b57ee578efa4223853ea0a535564b
SHA512

fedfb41d3854dfe1681aa0856e5d8e9a86cf3b6a94f04f3600176148c068a33337a6e55afd85bd9bcfddf96ee584f20d498e58514cea3c9fbf90cd20ddba9b85
SSDEEP

1536:bq+dX5z9lhsRbarmsapZyWK+0IStWJ+xruajIDUsL+JjiHq0VaO1FsPRFDmu+T4:bbdRhsRwmsmB4tCailUsLHq0VaODQD

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3480	rundll32.exe
3480	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 3480	3648	rundll32.exe	83
PID 3648 wrote to memory of 3480	3648	rundll32.exe	83
PID 3648 wrote to memory of 3480	3648	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0aafc1c15ca0e24ad6eb1d5f195b65_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0aafc1c15ca0e24ad6eb1d5f195b65_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3480

memory/3480-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3480-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3480-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3480-3-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download