Analysis
-
max time kernel
142s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fbc4707ef173c77f9a159cc753d0c7f8_JaffaCakes118.dll
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
fbc4707ef173c77f9a159cc753d0c7f8_JaffaCakes118.dll
Resource
win10v2004-20240412-en
1 signatures
150 seconds
General
-
Target
fbc4707ef173c77f9a159cc753d0c7f8_JaffaCakes118.dll
-
Size
72KB
-
MD5
fbc4707ef173c77f9a159cc753d0c7f8
-
SHA1
4e6505262f870f5bdf899283e73c8240ffa076a9
-
SHA256
ecd6dc664c8bbd82a2deec45c595ea32c5c51a7bd3567a77ad02046296529ba0
-
SHA512
5e3b1dedbab37fc24c0226392b71e92ea1d88f535f0fc23f768075b1a23a652ac81b21d7e0cc75db7630f7a3e80e0365d6453f32eefe022587f94b97fd41d215
-
SSDEEP
1536:KPZ4ryumkAdoo9zQX5T+arUAoeak0XrGqREESnfwj:KOryumkAdoo9zQpT+a4nk0XrGiVlj
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1020 wrote to memory of 5044 1020 rundll32.exe rundll32.exe PID 1020 wrote to memory of 5044 1020 rundll32.exe rundll32.exe PID 1020 wrote to memory of 5044 1020 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fbc4707ef173c77f9a159cc753d0c7f8_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fbc4707ef173c77f9a159cc753d0c7f8_JaffaCakes118.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5044-0-0x00000000009B0000-0x00000000009BA000-memory.dmpFilesize
40KB
-
memory/5044-2-0x0000000010000000-0x0000000010009000-memory.dmpFilesize
36KB
-
memory/5044-4-0x00000000009B0000-0x00000000009BA000-memory.dmpFilesize
40KB
-
memory/5044-8-0x00000000009B0000-0x00000000009BA000-memory.dmpFilesize
40KB