8d58720267b775c93f6caaa482269bd19556f6010be968c20ca057b51fe6c3ba

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 06:32

Target
408efa73570376679aa2aad883df294d_JaffaCakes118.dll
Size 306KB
Sample240713-has2dszcmr
SHA256 8d58720267b775c93f6caaa482269bd19556f6010be968c20ca057b51fe6c3ba
MD5 408efa73570376679aa2aad883df294d
SHA1 6b89f8f6b58b536d0978d7b03e27b9e64dfc975f
SHA512 ef4152c616d0ee562c7370de8db541694f4bc35e7fe1e2ffbcc0da45ac1ac2ae38ac46735996e32addbbd7e2d00cb74b07c0f7a5e6bd1a635d333192e5d90288
SSDEEP 6144:w4B6hecU++BKCav2wq6rLxehVMBalWsgMJGwFA9RxK3dchcqeA1gNF:sevdk03LMBQWmE+sRxKscqJ+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4512	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4512	4260	rundll32.exe	83
PID 4260 wrote to memory of 4512	4260	rundll32.exe	83
PID 4260 wrote to memory of 4512	4260	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\408efa73570376679aa2aad883df294d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\408efa73570376679aa2aad883df294d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4512

memory/4512-0-0x0000000010000000-0x00000000100A1000-memory.dmp

Download

memory/4512-1-0x0000000010000000-0x000000001009D000-memory.dmp

Download