Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 14:57
Behavioral task
behavioral1
Sample
8e780048701019bf5511ca2f4b58f53e_JaffaCakes118.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e780048701019bf5511ca2f4b58f53e_JaffaCakes118.dll
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
8e780048701019bf5511ca2f4b58f53e_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
8e780048701019bf5511ca2f4b58f53e
-
SHA1
003066429b194dcd774e8245cd9617064a181d00
-
SHA256
fb88d458d114015515829cffae2f7b8b9e9e3429f1dd969dbe0eb1e88d966d3a
-
SHA512
485f7cb8bc89484fe57116c17117e38df6d271c0df097a2521ddb1bd136d0c46a51a90e252cef7c49b88d07bcc3ced61a8f39f05b4339d79fb7f232ce8affa9c
-
SSDEEP
24576:Yu8WY4K5ntZEYDxQxdg9vw1+DyXswtc+mFTA0DQkIXWsI4pcue/AoNoV:d8WY4At7xQnghw8uXXtc+O7Dqm74p1
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1916-0-0x0000000074D00000-0x00000000750AA000-memory.dmp vmprotect behavioral2/memory/1916-1-0x0000000074D00000-0x00000000750AA000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3236 wrote to memory of 1916 3236 rundll32.exe 80 PID 3236 wrote to memory of 1916 3236 rundll32.exe 80 PID 3236 wrote to memory of 1916 3236 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8e780048701019bf5511ca2f4b58f53e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8e780048701019bf5511ca2f4b58f53e_JaffaCakes118.dll,#12⤵PID:1916
-