Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 15:57
Behavioral task
behavioral1
Sample
186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll
Resource
win7-20240215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll
Resource
win10v2004-20240419-en
1 signatures
150 seconds
General
-
Target
186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
186037ec84f11a9bb0eef72bc7c30408
-
SHA1
891e419f077e954d6e871c1c3f31fcd329347153
-
SHA256
1195e16b8f55b529ffad83b85190f3059b4c070e2f460269e4b368cbf8fe265e
-
SHA512
09c673800884cae0646228f3080e761b1ed8194f454e256e9a9f250b868df430016e8faef57a8abdba6a72dd38ba19272d4156dcdf45ee94c2bc2bd0f5b63eda
-
SSDEEP
24576:LwrdHxPHn+C9wIQw6vWZA2u6wvYk8PY9/Jg/l/YH:LwrDeO3M2uMk8Pug/2H
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2204 wrote to memory of 2940 2204 rundll32.exe rundll32.exe PID 2204 wrote to memory of 2940 2204 rundll32.exe rundll32.exe PID 2204 wrote to memory of 2940 2204 rundll32.exe rundll32.exe PID 2204 wrote to memory of 2940 2204 rundll32.exe rundll32.exe PID 2204 wrote to memory of 2940 2204 rundll32.exe rundll32.exe PID 2204 wrote to memory of 2940 2204 rundll32.exe rundll32.exe PID 2204 wrote to memory of 2940 2204 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll,#12⤵