0d100ce813ccfeadce042b12bfe50ada9dde14b526d5c984ff4c07fdcc07d3b3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 13:58

Target

49fad3cbea650f663255e3af5f83c79a_JaffaCakes118.dll
Size

27KB
MD5

49fad3cbea650f663255e3af5f83c79a
SHA1

3d4b3f77bd44018a1018970d38be06a5766d0938
SHA256

0d100ce813ccfeadce042b12bfe50ada9dde14b526d5c984ff4c07fdcc07d3b3
SHA512

a4833e2dcbf87c21ceed4b4563e3effc9bbebf18e3c3bead09ea6a1553d1699cfbd6d76755181d9722cfa0a8b6bbad7d2f96953b662c37433b124f9e8f637faa
SSDEEP

384:JtO1KHCc1zUm+kYpwoo4jIvSulFNm/C4MgXDRkTKeLrDuQG4IGzOmhBciPF:JtHzUm+PdIvSKc/XMgX21LWQTHzOmL7

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
708	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 708	524	rundll32.exe	83
PID 524 wrote to memory of 708	524	rundll32.exe	83
PID 524 wrote to memory of 708	524	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49fad3cbea650f663255e3af5f83c79a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49fad3cbea650f663255e3af5f83c79a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:708