ffb9a3d852fbe8b5259c9b39ef3f83f5e6f47cfa6bebe04d6337f273d8595557

Analysis

max time kernel
32s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 23:03

Target

3f397bd3834bd623c02198c522041d02_JaffaCakes118.dll
Size

314KB
MD5

3f397bd3834bd623c02198c522041d02
SHA1

2260d600e70ad8e4aba9106af42ec827322e1631
SHA256

ffb9a3d852fbe8b5259c9b39ef3f83f5e6f47cfa6bebe04d6337f273d8595557
SHA512

4094ce659547bd9f77400c158362f245412b9ca213756e1ae79862058b07eb885fc837b6568f193830022fd800bdafbae8973c3e2f52a1210c14da9b7674b3d2
SSDEEP

6144:iMjsycyX7bweBe/K6iCI5adO/WwkfiKTAQE6MIA+3NUSSX:iMjsycC47iCI5oqPc5MIx6SSX

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4312	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4312	4108	rundll32.exe	81
PID 4108 wrote to memory of 4312	4108	rundll32.exe	81
PID 4108 wrote to memory of 4312	4108	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f397bd3834bd623c02198c522041d02_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f397bd3834bd623c02198c522041d02_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4312

memory/4312-0-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/4312-1-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download