4427e4a8ff16e7c11cf37da3fb365901d81abb5f6422f12ecf8467f5c6af4b59

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 16:23

Target

63e80910f2ed45c190d28f1c29898f37_JaffaCakes118.dll
Size

705KB
MD5

63e80910f2ed45c190d28f1c29898f37
SHA1

9e030292196022933c09b31c7a68ccc11480997b
SHA256

4427e4a8ff16e7c11cf37da3fb365901d81abb5f6422f12ecf8467f5c6af4b59
SHA512

36ef0213a1870647c6709fbcef41c90a428417a3202767ad3912af437886a24789a0ec89a5cafa593aeed5dfecb0d3b10d74302ef0923acd8bf925dc87215441
SSDEEP

12288:LaXF2c2llbHDgmwkD8M8KMnQZJTXxcGsIH4jMw8LuBJsE00yqC1V4o4bHrW:eX32llr6koM8KGQbX+nIYjH8LuBXDy7F

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1700	1252	rundll32.exe	30
PID 1252 wrote to memory of 1700	1252	rundll32.exe	30
PID 1252 wrote to memory of 1700	1252	rundll32.exe	30
PID 1252 wrote to memory of 1700	1252	rundll32.exe	30
PID 1252 wrote to memory of 1700	1252	rundll32.exe	30
PID 1252 wrote to memory of 1700	1252	rundll32.exe	30
PID 1252 wrote to memory of 1700	1252	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63e80910f2ed45c190d28f1c29898f37_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63e80910f2ed45c190d28f1c29898f37_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1700