0c1a8808a9ca8815fd43100d87bef8aa3afb7bfeef1ff9a90c59247a4f696f52

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 19:34

Target

611d52102a31f35c68562bc3971481be_JaffaCakes118.dll
Size

12KB
MD5

611d52102a31f35c68562bc3971481be
SHA1

13cc6d38e72f660feddc0ade129742a69d686243
SHA256

0c1a8808a9ca8815fd43100d87bef8aa3afb7bfeef1ff9a90c59247a4f696f52
SHA512

7a8316106674d791b67645710c141387401f801cd376dd954877978dc9aa8739027ceb11fdd8bb3e88b02d6e038821fbfa0e175ce71d4db55070a505d752e383
SSDEEP

192:E2KMA4zjf42047XgoDMpfKWBcDOa7fB1aeH37Nc4ccE:E2K+X420GwoDMTyZ1RHLN1cc

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2636	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2636	2676	rundll32.exe	84
PID 2676 wrote to memory of 2636	2676	rundll32.exe	84
PID 2676 wrote to memory of 2636	2676	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\611d52102a31f35c68562bc3971481be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\611d52102a31f35c68562bc3971481be_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2636