5a19a9822ea114777ea9c67fec1f7412a297891eef975e513ba334d9059d066d

Analysis

max time kernel
94s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 09:40

Target

3cdb64c165c9cc00dc8703153db02c30_JaffaCakes118.dll
Size

318KB
MD5

3cdb64c165c9cc00dc8703153db02c30
SHA1

084e9172abfffd0d59068bba8fa2452db0e63fe5
SHA256

5a19a9822ea114777ea9c67fec1f7412a297891eef975e513ba334d9059d066d
SHA512

e0e31d3d1ca154c2aa9078ac266db4f35c627eb14c09410fcf2aa64111d07e21875adf4781720fc644e338c8ae601241dfbec38a1db4ac2f392f3c747af7db37
SSDEEP

6144:mvDDHy5z2wg9btsWXxntETMF4efN3VnlfxG4x+7UX9lwdpPbkg8TF+8W:GDS5zng5+8n8vMVlZF+7UTUTkg8R+8W

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1596	3116	rundll32.exe	83
PID 3116 wrote to memory of 1596	3116	rundll32.exe	83
PID 3116 wrote to memory of 1596	3116	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cdb64c165c9cc00dc8703153db02c30_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cdb64c165c9cc00dc8703153db02c30_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1596

memory/1596-0-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download