12fc9c997754be1ca81255742c5e23eed63105c4fac76b153a9616d7da785aee

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 03:43

Target

3bdf6a9f1e00f3aa493cfd40bcd934d4_JaffaCakes118.dll
Size

296KB
MD5

3bdf6a9f1e00f3aa493cfd40bcd934d4
SHA1

3e37dc76e84b09b6b8fe412176c015311a953f1a
SHA256

12fc9c997754be1ca81255742c5e23eed63105c4fac76b153a9616d7da785aee
SHA512

158db5b1b9790855456fd732675a3b4cc272e120987823b97e8b67c245847adc29a47ee95e2b2a8910224f6219ead1e8b131704717c2a6c5507838f4301b3738
SSDEEP

6144:J0AYvwcyyRwkThPLbUtd7P/1ZaiBfFTZyd/i+G:S8yRu1Z1N1yd/i+G

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4688	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4688	2588	rundll32.exe	83
PID 2588 wrote to memory of 4688	2588	rundll32.exe	83
PID 2588 wrote to memory of 4688	2588	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bdf6a9f1e00f3aa493cfd40bcd934d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bdf6a9f1e00f3aa493cfd40bcd934d4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4688

memory/4688-0-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/4688-1-0x0000000001120000-0x0000000001125000-memory.dmp

Filesize
20KB

Download
memory/4688-2-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/4688-3-0x0000000001120000-0x0000000001125000-memory.dmp

Filesize
20KB

Download