fddd9e17e3cf4aa948a7a0b643d3549f4b5d26242e0b0eb7510657bbbb890a22

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 23:01

Target

4bc987c690b2571dcbb619a2be3f4b19_JaffaCakes118.dll
Size

124KB
MD5

4bc987c690b2571dcbb619a2be3f4b19
SHA1

a0c2781d1378b3c594e9148b4898530ac93940a5
SHA256

fddd9e17e3cf4aa948a7a0b643d3549f4b5d26242e0b0eb7510657bbbb890a22
SHA512

5c8d93d9468bb6e2be52e6dd61f7403fc67d8e1c20ca6ed88643df68db7b0b7bdc023db1f619a00b37d0ba2bd997b955927df9c868b4c60a7dfdc2e760aba113
SSDEEP

3072:m4BoL2OwfLGSgThLPetSUeTBfoDXPiYMQO2J2:m4B6QL9gPKeTBgLda2J2

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3524	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3524	2920	rundll32.exe	83
PID 2920 wrote to memory of 3524	2920	rundll32.exe	83
PID 2920 wrote to memory of 3524	2920	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc987c690b2571dcbb619a2be3f4b19_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc987c690b2571dcbb619a2be3f4b19_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3524