Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 05:36
Behavioral task
behavioral1
Sample
1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
1635a433281238b10cb0d21ffed0055b
-
SHA1
036a24f91d872246f8d2ad0281c8014485e8fd3e
-
SHA256
84f22017f37b08a2bdd739a323f49e999b4d10ff2b66c0d7a122ce2b96771c2b
-
SHA512
4a2d4890043364d73236dc7ff91cc0f571c94a0d7344da7f703ccd386c9c4739fde5a4b6d2fcf5141dd8a0f3c7e0d874690b604a41224bc640aaee4dc46b6c2c
-
SSDEEP
24576:f85aVxdXTOncL9vLm9EnZKlVW5ri3vg7f5DsBr29y6n0ig1gcyY:FVnhv69WZKlVWpAg7fS129rnC1gcyY
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3160 wrote to memory of 3756 3160 rundll32.exe rundll32.exe PID 3160 wrote to memory of 3756 3160 rundll32.exe rundll32.exe PID 3160 wrote to memory of 3756 3160 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1635a433281238b10cb0d21ffed0055b_JaffaCakes118.dll,#12⤵