89085bc3936483f26d0bf636f17437630482ec9d227ece0f320f18e67dbaedee

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 13:34

Target

635ead3b33c52292e9b7fc91e8e90e73_JaffaCakes118.dll
Size

28KB
MD5

635ead3b33c52292e9b7fc91e8e90e73
SHA1

6e3fbe2978d201ae8696620eb419c7c65115ceac
SHA256

89085bc3936483f26d0bf636f17437630482ec9d227ece0f320f18e67dbaedee
SHA512

4ac6eb2b3ad17b17e47c09f5ca55d04830aa72eaa14713ed5b4e27d59ab1b5603205d3d7094e287abb6784207fb462eecb87930dfb7df0de4e7d7886fa76626a
SSDEEP

384:821eOshZRVI+B2dlzfORSDNIxD/yZznyjIzTeJAJa/1JlzOV6muQ9P6WRzfQwnjl:eRVgJDNIN/22IQW2lzOkMZRzfQwnjl

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1620	2028	rundll32.exe	84
PID 2028 wrote to memory of 1620	2028	rundll32.exe	84
PID 2028 wrote to memory of 1620	2028	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\635ead3b33c52292e9b7fc91e8e90e73_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\635ead3b33c52292e9b7fc91e8e90e73_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1620