a6fd05d4527eb7d8168b35d7672d51128ff2949fe4ff64f73ebdf9a7557c8ac4

Analysis

max time kernel
135s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 14:14

Target

3db595c3650109b51f7e3c74c7f946b3_JaffaCakes118.dll
Size

40KB
MD5

3db595c3650109b51f7e3c74c7f946b3
SHA1

4e6a397875bdaf374bc38fc4fe1c47dbc2a6f26f
SHA256

a6fd05d4527eb7d8168b35d7672d51128ff2949fe4ff64f73ebdf9a7557c8ac4
SHA512

36367578e4d8e90832df165992bfcd0c97e402823a33a7692a7ab6117a43c6d032a5c05cbf18aea808b77a552c42d5ba378dccf456cd6632be55c26cae1248bb
SSDEEP

384:aXN310jDOzhlK/nvt5YOyCR0pwE42xKh5HiKHCbyrLB+hL5CRqkmj3Uucm:aN3iDSlK/nxqpwQxXKHC+L4+Rmj3Uuc

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4176	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4176	4844	rundll32.exe	85
PID 4844 wrote to memory of 4176	4844	rundll32.exe	85
PID 4844 wrote to memory of 4176	4844	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3db595c3650109b51f7e3c74c7f946b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3db595c3650109b51f7e3c74c7f946b3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4176