Analysis
-
max time kernel
114s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll
-
Size
237KB
-
MD5
e9c6a23ce032ab05c258d5bc7c3d0c09
-
SHA1
6ab74fd863fc23018f55c922926e9f86cb4692c0
-
SHA256
6ade3de5683e919eccbad9004dbebdbac56e056e5c8ba34c047486b1cd221cde
-
SHA512
8b2bd14d48cd308856a7321c0ee06ec207dca1a6ab388b16a9a0340a8cadfe4749b5e4624f36f85b0afc5055da2d2f24133ca7ee84f47a515feff1e13b2e4b86
-
SSDEEP
6144:Amltx/EGUY+QYEnnaQeeaQeekQeesQee4jQeehQeee/sNVNzaYSMesy:AgDEGUYC0sNa/d
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4488 1056 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2572 wrote to memory of 1056 2572 rundll32.exe 91 PID 2572 wrote to memory of 1056 2572 rundll32.exe 91 PID 2572 wrote to memory of 1056 2572 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll,#12⤵PID:1056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 6763⤵
- Program crash
PID:4488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1056 -ip 10561⤵PID:3520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3748 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:81⤵PID:3020