Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 06:02
Behavioral task
behavioral1
Sample
164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
164d3eb9295c58aa47f7184482e837c6
-
SHA1
8dd418f665e6d0b3d9ad06dc5c0a0291283c9d7d
-
SHA256
e7d58bf051b2020e2ffab143e64867c1c752f2f53e41b7213187291396a68ff4
-
SHA512
e480adf4796fe72f4fef227cf450c552189ddfa52a14ea92c0009362b1824845d8d70c9c0683177022d47d920246549e48adea043e5a9c79a76faefac8282de1
-
SSDEEP
24576:RgDKNwzqg57SKQeNbhq0HgKsOwYGLD0MCg:67qg57Jjq05sO+W
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1948 wrote to memory of 2764 1948 rundll32.exe rundll32.exe PID 1948 wrote to memory of 2764 1948 rundll32.exe rundll32.exe PID 1948 wrote to memory of 2764 1948 rundll32.exe rundll32.exe PID 1948 wrote to memory of 2764 1948 rundll32.exe rundll32.exe PID 1948 wrote to memory of 2764 1948 rundll32.exe rundll32.exe PID 1948 wrote to memory of 2764 1948 rundll32.exe rundll32.exe PID 1948 wrote to memory of 2764 1948 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\164d3eb9295c58aa47f7184482e837c6_JaffaCakes118.dll,#12⤵