67c6f0784e3d55341c11ab5174f82df39e7b0a062572ab2cfb4148466c7207cc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 10:45

Target

38caf00d9b2614b378b5caada277cf2e_JaffaCakes118.dll
Size

705KB
MD5

38caf00d9b2614b378b5caada277cf2e
SHA1

630517995fed6a3775f734e6ef32d36d2b20b063
SHA256

67c6f0784e3d55341c11ab5174f82df39e7b0a062572ab2cfb4148466c7207cc
SHA512

fd56b7572033c6b695fb0cee47dd94019bd716376bca7e9058d41d8978621d65d3644307fe915b6f46cce457415feed1b92de9367af782bf7b8958ab50aaa2cc
SSDEEP

12288:LaXF2c2llbHDgmwkD8M8KMnQZJTXxcGsIH4jMw8LuBJsE00yqC1V4o4bHrd:eX32llr6koM8KGQbX+nIYjH8LuBXDy7G

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4084	2300	rundll32.exe	83
PID 2300 wrote to memory of 4084	2300	rundll32.exe	83
PID 2300 wrote to memory of 4084	2300	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38caf00d9b2614b378b5caada277cf2e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38caf00d9b2614b378b5caada277cf2e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4084

memory/4084-0-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download