Analysis
-
max time kernel
137s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 15:57
Behavioral task
behavioral1
Sample
186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll
Resource
win7-20240215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll
Resource
win10v2004-20240419-en
1 signatures
150 seconds
General
-
Target
186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
186037ec84f11a9bb0eef72bc7c30408
-
SHA1
891e419f077e954d6e871c1c3f31fcd329347153
-
SHA256
1195e16b8f55b529ffad83b85190f3059b4c070e2f460269e4b368cbf8fe265e
-
SHA512
09c673800884cae0646228f3080e761b1ed8194f454e256e9a9f250b868df430016e8faef57a8abdba6a72dd38ba19272d4156dcdf45ee94c2bc2bd0f5b63eda
-
SSDEEP
24576:LwrdHxPHn+C9wIQw6vWZA2u6wvYk8PY9/Jg/l/YH:LwrDeO3M2uMk8Pug/2H
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4904 wrote to memory of 708 4904 rundll32.exe rundll32.exe PID 4904 wrote to memory of 708 4904 rundll32.exe rundll32.exe PID 4904 wrote to memory of 708 4904 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\186037ec84f11a9bb0eef72bc7c30408_JaffaCakes118.dll,#12⤵