Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 08:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
912d4b815a4019db2f871787e0caa03e_JaffaCakes118.dll
Resource
win7-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
912d4b815a4019db2f871787e0caa03e_JaffaCakes118.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
912d4b815a4019db2f871787e0caa03e_JaffaCakes118.dll
-
Size
57KB
-
MD5
912d4b815a4019db2f871787e0caa03e
-
SHA1
80bc63d0e1d26ef31c2333012bc98245cdf3b0f6
-
SHA256
d27bc12b3d8edee11d4dfba2a63c615b7e59cde2d3115f83bc0c0c40204aed2c
-
SHA512
e188235f996279de1c2bde555cd78ce1f08b3d5f5fffd0cf1ed86861b7114e3d4a4206c6f26572820f485b1a1605486cd4feb984a06cdb55be0b150481a707d5
-
SSDEEP
1536:nI9js9uextF3wj6/32nQg1Pweef1LpEIjvsejjpTyn:gjs9ueHuw2Qg1oewRpDvsejjUn
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3220 wrote to memory of 4160 3220 rundll32.exe 90 PID 3220 wrote to memory of 4160 3220 rundll32.exe 90 PID 3220 wrote to memory of 4160 3220 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\912d4b815a4019db2f871787e0caa03e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\912d4b815a4019db2f871787e0caa03e_JaffaCakes118.dll,#12⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵PID:924