1d353d253349f1e3dd94f91173babfbe490718d2fd8a52ac0924be462722914c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 03:38

Target

379150e0372177cc83ee6fa148254791_JaffaCakes118.dll
Size

998KB
MD5

379150e0372177cc83ee6fa148254791
SHA1

e5f5b367a9df9398a6771703242282a84167eb2a
SHA256

1d353d253349f1e3dd94f91173babfbe490718d2fd8a52ac0924be462722914c
SHA512

97d65f30a16da71cbfeb55a441c313795e58d62f149021dd0cab662da2e91e10acea840ddf2da816b79b9d78466b77ae7af8568481838a402e18ee5ad2fde18c
SSDEEP

24576:uClEgFl1jrAbQ91qd/ir5OXrVPgP9pjGfAf4pa+Zv:uClVHBrAbg16u2PgPGfe4pak

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\379150e0372177cc83ee6fa148254791_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\379150e0372177cc83ee6fa148254791_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2200