5c1b068ed054fe665d36a9d0ee6cc4ab8b6e5e8983d7c2a706426753ff2fbd72

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 08:44

Target

628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll
Size

7KB
MD5

628e61477c1d785d91cee044a81e32a0
SHA1

20ee2e15cbcd16a1f21dc5b0adc7f99a16505ca2
SHA256

5c1b068ed054fe665d36a9d0ee6cc4ab8b6e5e8983d7c2a706426753ff2fbd72
SHA512

18503f7978d8632e02560c6250a7fd3553dbcfac00f4d2b5ee2d55b9fed1e72fc48a90e1fa4094ed04216b7c7fd0d5fdffbc89ec6658c87df3c47fa092b8cfd3
SSDEEP

96:HmqT1Ue9tHz5TSZPmAEdjY7ZosmOLEafhEctHSN:GqT1Ue1TSZP2duoWLL+TN

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2332	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2332	2328	rundll32.exe	31
PID 2328 wrote to memory of 2332	2328	rundll32.exe	31
PID 2328 wrote to memory of 2332	2328	rundll32.exe	31
PID 2328 wrote to memory of 2332	2328	rundll32.exe	31
PID 2328 wrote to memory of 2332	2328	rundll32.exe	31
PID 2328 wrote to memory of 2332	2328	rundll32.exe	31
PID 2328 wrote to memory of 2332	2328	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2332