Analysis

  • max time kernel
    141s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 07:55

General

  • Target

    f9daf78868ffd7c6fe582e48b66939a4_JaffaCakes118.dll

  • Size

    120KB

  • MD5

    f9daf78868ffd7c6fe582e48b66939a4

  • SHA1

    6d40c8bcdc919543579f7fd30456ef2af1ec7da6

  • SHA256

    ea085ef6d521046a0cf00556fa65892d20a3fb0dc35ff0e0e8d965856e64da4f

  • SHA512

    767e9b428f16345b1e7ce8eba3096950a0bb68a7eeb6a9fda7519b567d2c479254b89dfdff9c45b7fdb0f456b096e0787b7129c84db85ffb1417ead21a8c93c3

  • SSDEEP

    3072:2WWos0SgsfcwLGGQ0aNScn4Y4ULFQ9CuM8p0:2RgMSGBrcn439zM8p0

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9daf78868ffd7c6fe582e48b66939a4_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9daf78868ffd7c6fe582e48b66939a4_JaffaCakes118.dll,#1
      2⤵
        PID:2460

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2460-0-0x00000000001E0000-0x00000000001EB000-memory.dmp
      Filesize

      44KB

    • memory/2460-2-0x0000000010000000-0x000000001000A000-memory.dmp
      Filesize

      40KB

    • memory/2460-5-0x00000000001E0000-0x00000000001E1000-memory.dmp
      Filesize

      4KB