Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 23:26
Behavioral task
behavioral1
Sample
046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll
Resource
win7-20240611-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll
-
Size
217KB
-
MD5
046020ccfbc1b40f0e0ce263fc4edd7d
-
SHA1
b75f8fc351f45505982092ce804e7d1253a9cddd
-
SHA256
496f7cab87bf4831373b6defaf941d439959577e38097b631d961a55d6f11cc2
-
SHA512
f3596c3988e7561f3edb749990481609c0b9df7b507069b15092055177236654eacd733f886abc81a3c368751e21931a5187547f82d2d7bbb4e231e0f983150c
-
SSDEEP
6144:4oYnX3fnNzWKkqwT77zoX0VLqsfZpKLLs4UB9FE:4oa3f5Wp//Y0VLqsfKifFE
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1640 2032 rundll32.exe 28 PID 2032 wrote to memory of 1640 2032 rundll32.exe 28 PID 2032 wrote to memory of 1640 2032 rundll32.exe 28 PID 2032 wrote to memory of 1640 2032 rundll32.exe 28 PID 2032 wrote to memory of 1640 2032 rundll32.exe 28 PID 2032 wrote to memory of 1640 2032 rundll32.exe 28 PID 2032 wrote to memory of 1640 2032 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll,#12⤵PID:1640
-