Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 05:36
Behavioral task
behavioral1
Sample
1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
1635a433281238b10cb0d21ffed0055b
-
SHA1
036a24f91d872246f8d2ad0281c8014485e8fd3e
-
SHA256
84f22017f37b08a2bdd739a323f49e999b4d10ff2b66c0d7a122ce2b96771c2b
-
SHA512
4a2d4890043364d73236dc7ff91cc0f571c94a0d7344da7f703ccd386c9c4739fde5a4b6d2fcf5141dd8a0f3c7e0d874690b604a41224bc640aaee4dc46b6c2c
-
SSDEEP
24576:f85aVxdXTOncL9vLm9EnZKlVW5ri3vg7f5DsBr29y6n0ig1gcyY:FVnhv69WZKlVWpAg7fS129rnC1gcyY
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2004 wrote to memory of 1044 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 1044 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 1044 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 1044 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 1044 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 1044 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 1044 2004 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll,#12⤵