61232546a12b4ef6007cb3637f41ed973dce5e18412e92af3c2d88ee8f0ed9eb

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 03:11

Target

440d403513e8d133f0cdea1f74e5f93c_JaffaCakes118.dll
Size

124KB
MD5

440d403513e8d133f0cdea1f74e5f93c
SHA1

985b396bcac7f9ad3ba41e609864096e56cc88b8
SHA256

61232546a12b4ef6007cb3637f41ed973dce5e18412e92af3c2d88ee8f0ed9eb
SHA512

af9830eda3669fc3338bfed5cdb5ed4b4a7acc8d8c32b7a0e3a894e4e34057c9ee27296f9e014f2d7eaafe17b65c68f72e65725b98066bb5e536e1be72d6d202
SSDEEP

1536:42XZSXvAoOnr8lwDNGr1vHO96A+Vyv3uSEOL:bS/Avr/5GZvjTVyv3uSEO

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\440d403513e8d133f0cdea1f74e5f93c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\440d403513e8d133f0cdea1f74e5f93c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1628