78bb9a9e7306dadea571e37a6374e5f0b8fb2cf494f2c8a4364620a1d61c721f

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 23:17

Target

3f439ca14148007c6a2e6fbe3bbf261d_JaffaCakes118.dll
Size

44KB
MD5

3f439ca14148007c6a2e6fbe3bbf261d
SHA1

7abfe6af7f8bbb8cac1486b51bcec2ea41aef619
SHA256

78bb9a9e7306dadea571e37a6374e5f0b8fb2cf494f2c8a4364620a1d61c721f
SHA512

6999f36b70b81a3098414f3fe9934f5d081b3ef7ce28e0d564d9134be117bbbb8f0703695e6bb20685951648250566ec588211e6d9b59108c0c5a911fcb172c9
SSDEEP

384:i2HaViznUnkT3teiXSv1R0bb3JTfKXj5HDELV2NUSAq0H54cSWdu+20Duz1GA615:idxat1NH3J0j5jELcUSAq0HLxdUzUHB

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1240	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f439ca14148007c6a2e6fbe3bbf261d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f439ca14148007c6a2e6fbe3bbf261d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1240