Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 19:16
Behavioral task
behavioral1
Sample
1dfa61fbe9359427da31f18d9d32c92f_JaffaCakes118.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1dfa61fbe9359427da31f18d9d32c92f_JaffaCakes118.dll
Resource
win10v2004-20240419-en
1 signatures
150 seconds
General
-
Target
1dfa61fbe9359427da31f18d9d32c92f_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
1dfa61fbe9359427da31f18d9d32c92f
-
SHA1
90f6f569178fd79e6a88fbdc087690801c943fa7
-
SHA256
2379372b2bba3e17bbaa959b1c239d09f7d02c3b8b56e4fbd14676d88e6d18c9
-
SHA512
d44b14e4389fa3d3de893376832273180968fd76fbfd143fd93fa079bac8e9b96b4e24281629754408ded26b4b5a1538a42aa09ee525932f1d2166afa8af29c9
-
SSDEEP
24576:sB/8n6keaVrgsD4WLXUklVlJkHSK7d2iK:oM5Vrgk70/7d2iK
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2892 wrote to memory of 2972 2892 rundll32.exe rundll32.exe PID 2892 wrote to memory of 2972 2892 rundll32.exe rundll32.exe PID 2892 wrote to memory of 2972 2892 rundll32.exe rundll32.exe PID 2892 wrote to memory of 2972 2892 rundll32.exe rundll32.exe PID 2892 wrote to memory of 2972 2892 rundll32.exe rundll32.exe PID 2892 wrote to memory of 2972 2892 rundll32.exe rundll32.exe PID 2892 wrote to memory of 2972 2892 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfa61fbe9359427da31f18d9d32c92f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfa61fbe9359427da31f18d9d32c92f_JaffaCakes118.dll,#12⤵