113b7a97e6614955c8fb01f05891845fdd8deb6ce6c13b5f469262f84073d30a

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 23:43

Target

3f570d6ce7d048fd23f18e7dc9b9bc08_JaffaCakes118.dll
Size

314KB
MD5

3f570d6ce7d048fd23f18e7dc9b9bc08
SHA1

d8e278ed8e79def42579e27ce1286782193758b8
SHA256

113b7a97e6614955c8fb01f05891845fdd8deb6ce6c13b5f469262f84073d30a
SHA512

d3ab4d4ff8af054268995f392014d4586a53dac86e9ebbf4b64ccca24b35ff7006c4557f2409654adc1354c5d7b002aef726418d4e18dcd8a7de09d00026083f
SSDEEP

6144:AGGSnH+QhxKheiRZIGEmNlNH/a25jv0PVyxyEqRzYzjBU2fr7Xn3q:AGDHZqhl2mnFR5j/3YzWBUEn3q

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1072	3224	rundll32.exe	83
PID 3224 wrote to memory of 1072	3224	rundll32.exe	83
PID 3224 wrote to memory of 1072	3224	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f570d6ce7d048fd23f18e7dc9b9bc08_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f570d6ce7d048fd23f18e7dc9b9bc08_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1072

memory/1072-0-0x00000000007A0000-0x00000000007A5000-memory.dmp

Filesize
20KB

Download
memory/1072-1-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/1072-2-0x00000000007A0000-0x00000000007A5000-memory.dmp

Filesize
20KB

Download