8aa7174ce963b567f96e7d57b903e3dabfec4bb09189202931b0c09a2e474c72

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 03:02

Target

65e328074e96f55f1c1b10e7e0470821_JaffaCakes118.dll
Size

86KB
MD5

65e328074e96f55f1c1b10e7e0470821
SHA1

24eb89422097c17dfc6bfb0f96042f94ec42d325
SHA256

8aa7174ce963b567f96e7d57b903e3dabfec4bb09189202931b0c09a2e474c72
SHA512

188f6553887c6430981383a9e6f7523be37a29641105a9bc0dfec21b5ee8a28b1d59b50c627933e6aa1c07ca34a656908cfaf196d606fd5d5a9060f363b263c0
SSDEEP

1536:bq+dX5z9lhsRbarmsapZyWK+0IStWJ+xruajIDUsL+JjiHq0VaO1FsPRFDmu+T2:bbdRhsRwmsmB4tCailUsLHq0VaODQp

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1044	rundll32.exe
1044	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1044	3648	rundll32.exe	84
PID 3648 wrote to memory of 1044	3648	rundll32.exe	84
PID 3648 wrote to memory of 1044	3648	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65e328074e96f55f1c1b10e7e0470821_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65e328074e96f55f1c1b10e7e0470821_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1044

memory/1044-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/1044-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1044-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/1044-3-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download