Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 12:16
Behavioral task
behavioral1
Sample
179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
179f8339027039863bb21cbf05cb03f2
-
SHA1
183e32a22c21743b0b4dde9d186450a53cacc2d0
-
SHA256
10b7655d26c3a7fc23ea6179c7853f1ce073511a9785a3dc54670daff521291d
-
SHA512
0141796b8f06ba7a8ecfaaac63b6d7c2a567e50d0ee99ac7f8a242093b31c74e17c9150efe800ed2ab015dbb23ab8fed8b5b08331829788dbbeb4bd275b3d33c
-
SSDEEP
24576:x5ZIU3ZZYvxM5n0gF97oIlYIJxrzkpakUwguJjf6:FIMegfF9ze65zkAkUI6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2020 wrote to memory of 2320 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 2320 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 2320 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 2320 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 2320 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 2320 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 2320 2020 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\179f8339027039863bb21cbf05cb03f2_JaffaCakes118.dll,#12⤵