1d353d253349f1e3dd94f91173babfbe490718d2fd8a52ac0924be462722914c

Analysis

max time kernel
95s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 03:38

Target

379150e0372177cc83ee6fa148254791_JaffaCakes118.dll
Size

998KB
MD5

379150e0372177cc83ee6fa148254791
SHA1

e5f5b367a9df9398a6771703242282a84167eb2a
SHA256

1d353d253349f1e3dd94f91173babfbe490718d2fd8a52ac0924be462722914c
SHA512

97d65f30a16da71cbfeb55a441c313795e58d62f149021dd0cab662da2e91e10acea840ddf2da816b79b9d78466b77ae7af8568481838a402e18ee5ad2fde18c
SSDEEP

24576:uClEgFl1jrAbQ91qd/ir5OXrVPgP9pjGfAf4pa+Zv:uClVHBrAbg16u2PgPGfe4pak

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2552	1176	rundll32.exe	83
PID 1176 wrote to memory of 2552	1176	rundll32.exe	83
PID 1176 wrote to memory of 2552	1176	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\379150e0372177cc83ee6fa148254791_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\379150e0372177cc83ee6fa148254791_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2552

memory/2552-0-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download