8ced0b270b62377e35ae4e7d2335261381d5021b96ac8e637c9a5c9773088eb0

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 11:26

Target

4e1a4cc882a200286e3c037cb916289d_JaffaCakes118.dll
Size

27KB
MD5

4e1a4cc882a200286e3c037cb916289d
SHA1

8182bdcbf71a3b13f7ca02a37124cb1c8ef74c1f
SHA256

8ced0b270b62377e35ae4e7d2335261381d5021b96ac8e637c9a5c9773088eb0
SHA512

2815157da1316e6bde9d5db9ad8681832a2cfee43f720d5f5456187d7f0ff93328feaf1ad1c5aeff5657e4f5aa43232fec06f5a7da9dad421c49a621f1fb09ff
SSDEEP

384:uIhkDmGStupDL/I/RApACnhgzuX49qAKIHO4yCkWytKg6W0bMQtFYi:ZhWmUDLA/R4n7Gqh94yCkTZ8MWFYi

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1708	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1708	1404	rundll32.exe	30
PID 1404 wrote to memory of 1708	1404	rundll32.exe	30
PID 1404 wrote to memory of 1708	1404	rundll32.exe	30
PID 1404 wrote to memory of 1708	1404	rundll32.exe	30
PID 1404 wrote to memory of 1708	1404	rundll32.exe	30
PID 1404 wrote to memory of 1708	1404	rundll32.exe	30
PID 1404 wrote to memory of 1708	1404	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1a4cc882a200286e3c037cb916289d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1a4cc882a200286e3c037cb916289d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1708