893d06cf590bc3edcfcec0c865aea1f206a378d81328776ab8d74a08aae0d54c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 11:00

Target

497e1d0df99529f87b1ddbe6cb024386_JaffaCakes118.dll
Size

6KB
MD5

497e1d0df99529f87b1ddbe6cb024386
SHA1

22ce9bede3e207037d53c4350bd97f26b7924f9e
SHA256

893d06cf590bc3edcfcec0c865aea1f206a378d81328776ab8d74a08aae0d54c
SHA512

997c5683dd15b4a0b5abb72b5702df4f4a075a4c7def4a67d8935eb5b5263bff92421921cbd11f43dbfc17f6e31e9c9bc080e3177ff30bf770a376d11a61a6ec
SSDEEP

96:Z1D/fIA1pNW0xbAp6etGG1cTyYJXC79fmKcp5hM3/EUcauxeWjOE:3XNWnGBTU7VmKcpHgLcddjO

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1240	rundll32.exe
1240	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\497e1d0df99529f87b1ddbe6cb024386_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\497e1d0df99529f87b1ddbe6cb024386_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1240

memory/1240-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download