c5ff1513f76b7f286c2adfd195f703af6fe304717267bc9f453a106cb79a13d8

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 07:54

Target

40d26f469e708eaf93f1787a06b3b41f_JaffaCakes118.dll
Size

91KB
MD5

40d26f469e708eaf93f1787a06b3b41f
SHA1

2a04685fcf013b59969f028748b6256c61eb1b87
SHA256

c5ff1513f76b7f286c2adfd195f703af6fe304717267bc9f453a106cb79a13d8
SHA512

defbb755dc5edae6087248b1e42dcd21fd03ac696abbb5159b9f6c2c5df55580fb64c1f284c5463dcb9712da0d8e93fc62ac2c867d85452d0bf5af8fa928e952
SSDEEP

1536:O5Z7fAex6ZQS/OyaDIzqNdHLm/JhoAaelJNajH56gMKoaEqoS25OQzPBlj2aGH:8Ae4KSGynqNdqhlJNO/Q9qo3fB0aU

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4600	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4600	3872	rundll32.exe	82
PID 3872 wrote to memory of 4600	3872	rundll32.exe	82
PID 3872 wrote to memory of 4600	3872	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40d26f469e708eaf93f1787a06b3b41f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40d26f469e708eaf93f1787a06b3b41f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4600

memory/4600-2-0x0000000002BE0000-0x0000000002CC7000-memory.dmp

Filesize
924KB

Download
memory/4600-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4600-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4600-3-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4600-5-0x0000000002BE0000-0x0000000002CC7000-memory.dmp

Filesize
924KB

Download