Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:12
Static task
static1
Behavioral task
behavioral1
Sample
6968a68e23dcbbd05114c8d6755ba5dd_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6968a68e23dcbbd05114c8d6755ba5dd_JaffaCakes118.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
6968a68e23dcbbd05114c8d6755ba5dd_JaffaCakes118.dll
-
Size
4.0MB
-
MD5
6968a68e23dcbbd05114c8d6755ba5dd
-
SHA1
7e2e6f126f71ab79e886d11673fc0219a0f49cdc
-
SHA256
a3508ad32336d39199bb2f2d12a574a16395afbbd239e191df2df43015041570
-
SHA512
87a0b83523de4c77885c6aeb04bf1c319b1994420f4d5bf4fe3fa77072da01ed9562ead0e465fd74dd13bec677851dc2f1ba6596d47b2e6600648bb4b9960bd5
-
SSDEEP
98304:OxUdjivsPZy3V1NCKNy3RjzndkfuVA6BLKoA:OeUEPUl/LNoRWh6ooA
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2136 3068 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3020 wrote to memory of 3068 3020 rundll32.exe rundll32.exe PID 3020 wrote to memory of 3068 3020 rundll32.exe rundll32.exe PID 3020 wrote to memory of 3068 3020 rundll32.exe rundll32.exe PID 3020 wrote to memory of 3068 3020 rundll32.exe rundll32.exe PID 3020 wrote to memory of 3068 3020 rundll32.exe rundll32.exe PID 3020 wrote to memory of 3068 3020 rundll32.exe rundll32.exe PID 3020 wrote to memory of 3068 3020 rundll32.exe rundll32.exe PID 3068 wrote to memory of 2136 3068 rundll32.exe WerFault.exe PID 3068 wrote to memory of 2136 3068 rundll32.exe WerFault.exe PID 3068 wrote to memory of 2136 3068 rundll32.exe WerFault.exe PID 3068 wrote to memory of 2136 3068 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6968a68e23dcbbd05114c8d6755ba5dd_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6968a68e23dcbbd05114c8d6755ba5dd_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 2603⤵
- Program crash