Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 23:26
Behavioral task
behavioral1
Sample
046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll
Resource
win7-20240611-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll
-
Size
217KB
-
MD5
046020ccfbc1b40f0e0ce263fc4edd7d
-
SHA1
b75f8fc351f45505982092ce804e7d1253a9cddd
-
SHA256
496f7cab87bf4831373b6defaf941d439959577e38097b631d961a55d6f11cc2
-
SHA512
f3596c3988e7561f3edb749990481609c0b9df7b507069b15092055177236654eacd733f886abc81a3c368751e21931a5187547f82d2d7bbb4e231e0f983150c
-
SSDEEP
6144:4oYnX3fnNzWKkqwT77zoX0VLqsfZpKLLs4UB9FE:4oa3f5Wp//Y0VLqsfKifFE
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3488 wrote to memory of 1500 3488 rundll32.exe 80 PID 3488 wrote to memory of 1500 3488 rundll32.exe 80 PID 3488 wrote to memory of 1500 3488 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\046020ccfbc1b40f0e0ce263fc4edd7d_JaffaCakes118.dll,#12⤵PID:1500
-