b275e09500c2151b045d58229e7e1c816c19b11becc99569909f6b341b34da5c

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 18:39

Target

60faee9e8aed74ebe3f58fa133daa5b9_JaffaCakes118.dll
Size

1.0MB
MD5

60faee9e8aed74ebe3f58fa133daa5b9
SHA1

da5a9f64bb06eff33907b74cf8b9aaffa7bd6471
SHA256

b275e09500c2151b045d58229e7e1c816c19b11becc99569909f6b341b34da5c
SHA512

95739ce51992b853fb3783082bc99792c8df93b17f2bc0e53a6579770b8c9e1cc387cce12169cf0a7d8363859d4028d2027e349a9a4bb87aca554d1b5dab6b4e
SSDEEP

24576:1uecA7PGEWOrT4GFGo8+JcBlMfKh90tlRqN0eqb:QAyVOr6kcXMfKAfqNMb

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4132	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4132	1964	rundll32.exe	84
PID 1964 wrote to memory of 4132	1964	rundll32.exe	84
PID 1964 wrote to memory of 4132	1964	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60faee9e8aed74ebe3f58fa133daa5b9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60faee9e8aed74ebe3f58fa133daa5b9_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4132