Analysis
-
max time kernel
139s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 20:29
Behavioral task
behavioral1
Sample
00591199ff0577f61d9e786eb3a822f7_JaffaCakes118.dll
Resource
win7-20240611-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
00591199ff0577f61d9e786eb3a822f7_JaffaCakes118.dll
Resource
win10v2004-20240611-en
1 signatures
150 seconds
General
-
Target
00591199ff0577f61d9e786eb3a822f7_JaffaCakes118.dll
-
Size
104KB
-
MD5
00591199ff0577f61d9e786eb3a822f7
-
SHA1
dfd3d0619dadea11fbe55a594602130d612f5770
-
SHA256
9426592f8ef7779bc75252a83e497cc0e3fa35fe8f13aef49ed88eb141d07cb0
-
SHA512
689495863d2c3b9ee2e111a96fdc62df88bcf903387bfbdfc98232228bb8cc4d1b87f490c086f253b4a101104e867ae2d52643a91e5b6a8fd2b0ee5ba09879ff
-
SSDEEP
1536:E1dhZ+C1CV+78WBnpt/sl5hQ6dcMnyfha0TemlpC5KTjC:8dhZb19duQ6dXnEha0ymlpC5KTjC
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4588 wrote to memory of 712 4588 rundll32.exe rundll32.exe PID 4588 wrote to memory of 712 4588 rundll32.exe rundll32.exe PID 4588 wrote to memory of 712 4588 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00591199ff0577f61d9e786eb3a822f7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00591199ff0577f61d9e786eb3a822f7_JaffaCakes118.dll,#12⤵PID:712