Analysis
-
max time kernel
135s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 05:01
Static task
static1
Behavioral task
behavioral1
Sample
0d926f240d834c580425a3980778daa4_JaffaCakes118.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d926f240d834c580425a3980778daa4_JaffaCakes118.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0d926f240d834c580425a3980778daa4_JaffaCakes118.dll
-
Size
1018KB
-
MD5
0d926f240d834c580425a3980778daa4
-
SHA1
9f883c277a981cf30cdc94a05baec2e9a6332bc7
-
SHA256
a4b477df3cfca22f5c3fb8977eb4149aedfeee113c0957ad0f9539d55a0fb5ea
-
SHA512
7b7001cc5e3edf5c0e74d8c624d6725eb75e7058683de6a7ef365f8a2690d07deef8f9e0a60afc5b338c61338bcfe064e890525b59c29df8d328c641f2655bd9
-
SSDEEP
24576:ByjfZTOF6W5rArdllMNas9uJbCIn16THWfI:BMZ46W5r8XPh16T2g
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2012 3604 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3920 wrote to memory of 3604 3920 rundll32.exe 85 PID 3920 wrote to memory of 3604 3920 rundll32.exe 85 PID 3920 wrote to memory of 3604 3920 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d926f240d834c580425a3980778daa4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d926f240d834c580425a3980778daa4_JaffaCakes118.dll,#12⤵PID:3604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 6403⤵
- Program crash
PID:2012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3604 -ip 36041⤵PID:716