3d7e507c7db240372934f26bcb5d966206b5009939412f525e5079cfff221f46

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 02:45

Target

5a26b4b18e5531001c176c04e2dad024_JaffaCakes118.dll
Size

32KB
MD5

5a26b4b18e5531001c176c04e2dad024
SHA1

d51dd8d3d4b493c79fda9eaa10ee72388e255426
SHA256

3d7e507c7db240372934f26bcb5d966206b5009939412f525e5079cfff221f46
SHA512

0de0828419a03105f326b787c8e01a6dde6086e1208bce00220301c63fc2c0025278451d12497d3e1969883b313deefdc72046e66705a89586143f8f0e3e83a0
SSDEEP

192:u0hC7dehzrKzOl+za7uerDho6y/fV3u8u514skIVFPaOFPWk1vMTP+4U/Tnb:pYdONl++hrDh2u8ubrTVVWk1v4P+4cT

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2928	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2928	3628	rundll32.exe	84
PID 3628 wrote to memory of 2928	3628	rundll32.exe	84
PID 3628 wrote to memory of 2928	3628	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a26b4b18e5531001c176c04e2dad024_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a26b4b18e5531001c176c04e2dad024_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2928

memory/2928-0-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download