90493ac0375ce6f85600defceafb5b14157fbf4fcb5ccbc5a952a40940b7b7c4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 03:50

Target

48188753a0cb0d4dd80680d007229b95_JaffaCakes118.dll
Size

128KB
MD5

48188753a0cb0d4dd80680d007229b95
SHA1

4a1ef8b2651171e2bd3dc5c855bd8cbc6ac9396a
SHA256

90493ac0375ce6f85600defceafb5b14157fbf4fcb5ccbc5a952a40940b7b7c4
SHA512

4a544a0b395a80cc0077b6035ee6fc2cc2134fb05f1460b6dd0eacc43ecae515fd775364e40b7a77cc3d43f59296906fb6e79ec2c4805c595b7b7709452a7a7f
SSDEEP

3072:bbBgAYaJm6/I2HojloO4VEyQTnGgSIt6YVokefaR:b+AZ86/I2Iy7tqGXIR8

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1044	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1044	2932	rundll32.exe	28
PID 2932 wrote to memory of 1044	2932	rundll32.exe	28
PID 2932 wrote to memory of 1044	2932	rundll32.exe	28
PID 2932 wrote to memory of 1044	2932	rundll32.exe	28
PID 2932 wrote to memory of 1044	2932	rundll32.exe	28
PID 2932 wrote to memory of 1044	2932	rundll32.exe	28
PID 2932 wrote to memory of 1044	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48188753a0cb0d4dd80680d007229b95_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48188753a0cb0d4dd80680d007229b95_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1044