20d6efb5788cbd0563540424238b392572bbcb413d08056b1066d5d73af0f0c1

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 07:19

Target

44d7406cf9937fffb7269205bae29c36_JaffaCakes118.dll
Size

196KB
MD5

44d7406cf9937fffb7269205bae29c36
SHA1

dac70c8fda35b6e8ec8b5a27d27e731fb5e0111f
SHA256

20d6efb5788cbd0563540424238b392572bbcb413d08056b1066d5d73af0f0c1
SHA512

046e25c3e296a72c3b3f1706af9c680463fb3785e7e1289219d89a1ba2bb1801f02664d07d4905a8140d97def08a7a57515228dcc2b816923edd87fb12b2a30d
SSDEEP

3072:6zdHS/h44HWy7pAn96VOPR/DHOjqciTn97VHmgGN7saG40jbtxZj:rQopAIqDOjqciB7VGwzN

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1232	2532	rundll32.exe	29
PID 2532 wrote to memory of 1232	2532	rundll32.exe	29
PID 2532 wrote to memory of 1232	2532	rundll32.exe	29
PID 2532 wrote to memory of 1232	2532	rundll32.exe	29
PID 2532 wrote to memory of 1232	2532	rundll32.exe	29
PID 2532 wrote to memory of 1232	2532	rundll32.exe	29
PID 2532 wrote to memory of 1232	2532	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d7406cf9937fffb7269205bae29c36_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d7406cf9937fffb7269205bae29c36_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1232

memory/1232-3-0x0000000074A91000-0x0000000074A92000-memory.dmp

Filesize
4KB

Download
memory/1232-11-0x0000000074A80000-0x0000000074B90000-memory.dmp

Filesize
1.1MB

Download
memory/1232-13-0x0000000074A80000-0x0000000074B90000-memory.dmp

Filesize
1.1MB

Download
memory/1232-12-0x0000000074A80000-0x0000000074B90000-memory.dmp

Filesize
1.1MB

Download