Analysis
-
max time kernel
132s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 11:11
Behavioral task
behavioral1
Sample
2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll
Resource
win10v2004-20240419-en
1 signatures
150 seconds
General
-
Target
2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
2067f3df259b6aac08bf1e755b265edd
-
SHA1
980a051823ac621f41b68db42aaa98ea4c1dd108
-
SHA256
9d10f3830527638dc6518cdc2a5adc2d91aea512d507939678b04c312078b25c
-
SHA512
acb1a497c0efc0cd5a99a6784b10d1b306bb4d30cd5cb1661529d1d76e236e2590962a7e0df917967b9d7194b8f353554e1a150c5d0411059ba37ba86e3880f8
-
SSDEEP
24576:QxCjV8F383ji1dSUxhXTXPbFbGPEOsQUVRkUIpg:cn3Oji1xXTlcsQUVRKpg
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3928 wrote to memory of 3920 3928 rundll32.exe rundll32.exe PID 3928 wrote to memory of 3920 3928 rundll32.exe rundll32.exe PID 3928 wrote to memory of 3920 3928 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2067f3df259b6aac08bf1e755b265edd_JaffaCakes118.dll,#12⤵