Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 07:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d279cadd4b2eb7a08e022e8161a26db_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d279cadd4b2eb7a08e022e8161a26db_JaffaCakes118.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
0d279cadd4b2eb7a08e022e8161a26db_JaffaCakes118.dll
-
Size
64KB
-
MD5
0d279cadd4b2eb7a08e022e8161a26db
-
SHA1
98c031e4b62a4d3ad89df237b6acacf5a5ddabef
-
SHA256
c553ceca2c2d91c788bd1664340aeef1683a887b5e6b2cdee9be4a0ebcd50f2a
-
SHA512
0861559a97b7ad4f69216f21c1d1966d28ecc9346851eb9d1721d6080bf31c1782171016e31572d55da506011198564ecadef00903fa5edb6de84e692b2a09e5
-
SSDEEP
1536:JI+/BZMxONSokqek22JM51UvQa1LznSPpP:JI8jDNnkH92JMvIM
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4352 4940 rundll32.exe 83 PID 4940 wrote to memory of 4352 4940 rundll32.exe 83 PID 4940 wrote to memory of 4352 4940 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d279cadd4b2eb7a08e022e8161a26db_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d279cadd4b2eb7a08e022e8161a26db_JaffaCakes118.dll,#12⤵PID:4352
-