Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91763cf38a8073c3ed2a87511fcc2437_JaffaCakes118.dll
Resource
win7-20240215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
91763cf38a8073c3ed2a87511fcc2437_JaffaCakes118.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
91763cf38a8073c3ed2a87511fcc2437_JaffaCakes118.dll
-
Size
4KB
-
MD5
91763cf38a8073c3ed2a87511fcc2437
-
SHA1
40c8b21687e8b4f36f65932459568b1fff5a42f6
-
SHA256
6f2dea10fd2fcf3afe314bd480f07c08f4ffbf211c1cc5c8634d598f4da26da3
-
SHA512
11076036c69568d488cff45d7d3e8da4d913dc1c86a4a5019a73eccfa0ec3f679f88d394e53a07687a243ed6dcb0e12275712c5f2308fbaae97d86ee9e097dad
-
SSDEEP
48:a5z4K+cmATmRYoRZCTJzJrd/DpRe4sl8OaIBangQc:MTWnRZ0lJFpsl8j3gQc
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2356 2352 rundll32.exe 29 PID 2352 wrote to memory of 2356 2352 rundll32.exe 29 PID 2352 wrote to memory of 2356 2352 rundll32.exe 29 PID 2352 wrote to memory of 2356 2352 rundll32.exe 29 PID 2352 wrote to memory of 2356 2352 rundll32.exe 29 PID 2352 wrote to memory of 2356 2352 rundll32.exe 29 PID 2352 wrote to memory of 2356 2352 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91763cf38a8073c3ed2a87511fcc2437_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91763cf38a8073c3ed2a87511fcc2437_JaffaCakes118.dll,#12⤵PID:2356
-