c5ff1513f76b7f286c2adfd195f703af6fe304717267bc9f453a106cb79a13d8

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 07:54

Target

40d26f469e708eaf93f1787a06b3b41f_JaffaCakes118.dll
Size

91KB
MD5

40d26f469e708eaf93f1787a06b3b41f
SHA1

2a04685fcf013b59969f028748b6256c61eb1b87
SHA256

c5ff1513f76b7f286c2adfd195f703af6fe304717267bc9f453a106cb79a13d8
SHA512

defbb755dc5edae6087248b1e42dcd21fd03ac696abbb5159b9f6c2c5df55580fb64c1f284c5463dcb9712da0d8e93fc62ac2c867d85452d0bf5af8fa928e952
SSDEEP

1536:O5Z7fAex6ZQS/OyaDIzqNdHLm/JhoAaelJNajH56gMKoaEqoS25OQzPBlj2aGH:8Ae4KSGynqNdqhlJNO/Q9qo3fB0aU

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30
PID 2976 wrote to memory of 2200	2976	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40d26f469e708eaf93f1787a06b3b41f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40d26f469e708eaf93f1787a06b3b41f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2200

memory/2200-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2200-2-0x00000000007A0000-0x0000000000887000-memory.dmp

Filesize
924KB

Download
memory/2200-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2200-3-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2200-5-0x00000000007A0000-0x0000000000887000-memory.dmp

Filesize
924KB

Download