0cffdf53bd0fc05f16dcbade93504c260d236e9228522b1bbb04cd1661494741

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 00:16

Target

3b489ca138175ba816b0b6fa81098216_JaffaCakes118.dll
Size

72KB
MD5

3b489ca138175ba816b0b6fa81098216
SHA1

4fae1ec153404b65ac097c793ad5e06aad094c7c
SHA256

0cffdf53bd0fc05f16dcbade93504c260d236e9228522b1bbb04cd1661494741
SHA512

4bdfe07278025fd522f76084b3e4619a41c586889c27f4e4db3c28e92a60e6df76c94b175fd3d9c91972bf52c514054e97d065123c4aca6165dd190267d5259b
SSDEEP

1536:EPdLF6hUOLtIo4KHRJkpqXwOn8KATc0+3LHDcc9vgkVM7KX7Sm:EPlF/0IL+RJZ5dAQ33LHDX9o/7KXW

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1784	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1784	2416	rundll32.exe	30
PID 2416 wrote to memory of 1784	2416	rundll32.exe	30
PID 2416 wrote to memory of 1784	2416	rundll32.exe	30
PID 2416 wrote to memory of 1784	2416	rundll32.exe	30
PID 2416 wrote to memory of 1784	2416	rundll32.exe	30
PID 2416 wrote to memory of 1784	2416	rundll32.exe	30
PID 2416 wrote to memory of 1784	2416	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b489ca138175ba816b0b6fa81098216_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b489ca138175ba816b0b6fa81098216_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1784