5c1b068ed054fe665d36a9d0ee6cc4ab8b6e5e8983d7c2a706426753ff2fbd72

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 08:44

Target

628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll
Size

7KB
MD5

628e61477c1d785d91cee044a81e32a0
SHA1

20ee2e15cbcd16a1f21dc5b0adc7f99a16505ca2
SHA256

5c1b068ed054fe665d36a9d0ee6cc4ab8b6e5e8983d7c2a706426753ff2fbd72
SHA512

18503f7978d8632e02560c6250a7fd3553dbcfac00f4d2b5ee2d55b9fed1e72fc48a90e1fa4094ed04216b7c7fd0d5fdffbc89ec6658c87df3c47fa092b8cfd3
SSDEEP

96:HmqT1Ue9tHz5TSZPmAEdjY7ZosmOLEafhEctHSN:GqT1Ue1TSZP2duoWLL+TN

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
700	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 700	760	rundll32.exe	84
PID 760 wrote to memory of 700	760	rundll32.exe	84
PID 760 wrote to memory of 700	760	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:700