Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 08:44
Behavioral task
behavioral1
Sample
16e0b3032519c778f5ef00e44b7b0a0c_JaffaCakes118.dll
Resource
win7-20240220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
16e0b3032519c778f5ef00e44b7b0a0c_JaffaCakes118.dll
Resource
win10v2004-20240419-en
1 signatures
150 seconds
General
-
Target
16e0b3032519c778f5ef00e44b7b0a0c_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
16e0b3032519c778f5ef00e44b7b0a0c
-
SHA1
f991f39165a1a5798fa427e88abc39c203b289b7
-
SHA256
0013ae86090ecf18a039857ffa4c71d45918ee995080bee013754e37ac9cbe4a
-
SHA512
bbc30cd73b20d93956bb743551eee1b78e38cb80c79adc2b203dd9c69a4f2a6de6c4836cf4386344b096ba50a86cb48d6347790949ef4fdd7a6416eadd3ec710
-
SSDEEP
24576:qfCaf/YQGzEGsGoEZXQJZ8mG6iKNYo122piZKHAsFvINnZGw1Pf:xarGJoEGaD6icpQsBINV
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3012 wrote to memory of 3388 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 3388 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 3388 3012 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16e0b3032519c778f5ef00e44b7b0a0c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16e0b3032519c778f5ef00e44b7b0a0c_JaffaCakes118.dll,#12⤵