Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
8c6894f8025769ce7875739d4026d2df_JaffaCakes118.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c6894f8025769ce7875739d4026d2df_JaffaCakes118.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
8c6894f8025769ce7875739d4026d2df_JaffaCakes118.dll
-
Size
840KB
-
MD5
8c6894f8025769ce7875739d4026d2df
-
SHA1
06bbeb89ab1de89a939c1a0568d9b1dd3de8981c
-
SHA256
20d92487504abee37914cd3fdffd12b837061beceebecd6ac7435571c9885529
-
SHA512
d4e746ec59a288e1a8243133afe9ce35178dbb76877a917108148b25fce184ed91f6a5f866e25f717f21df58e02c2dd948ea6799143fc870931c2c1c44c5164a
-
SSDEEP
12288:Ilvr7IWUQQDKWYtIJgCKxbODr6RsC5Mkr+Kw498VgSLQtRsjyM:Il3GQQuhYgpiryMWGWaD
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1916 wrote to memory of 232 1916 rundll32.exe 83 PID 1916 wrote to memory of 232 1916 rundll32.exe 83 PID 1916 wrote to memory of 232 1916 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c6894f8025769ce7875739d4026d2df_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c6894f8025769ce7875739d4026d2df_JaffaCakes118.dll,#12⤵PID:232
-