Analysis
-
max time kernel
51s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 19:17
Behavioral task
behavioral1
Sample
0f37ec83239182c2ab3a442317da3e6d_JaffaCakes118.dll
Resource
win7-20240611-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f37ec83239182c2ab3a442317da3e6d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
0f37ec83239182c2ab3a442317da3e6d_JaffaCakes118.dll
-
Size
14KB
-
MD5
0f37ec83239182c2ab3a442317da3e6d
-
SHA1
6b3fc7663eaf4d84361325eeed595398ef335fd9
-
SHA256
ea6bb60718533159bcb42cf82f88212b1b0e1d10a6a18356c0bb92f3af6b3658
-
SHA512
5f1491dc9a4e5abdf86c40e5b65ac447afa7432f2ce95e405f2567778a3cfb2206fe9fa1acf899457cf7ab2cc9e3d84571abb2d1bed6f29881104d8136ec53a4
-
SSDEEP
384:E2eiTVganwoVGjr2L3pkMXJiSoeL3qZI0dETDAZH:E2ik2r2N3XJiSbWIp
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3288-0-0x0000000010000000-0x0000000010015000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3604 wrote to memory of 3288 3604 rundll32.exe 83 PID 3604 wrote to memory of 3288 3604 rundll32.exe 83 PID 3604 wrote to memory of 3288 3604 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f37ec83239182c2ab3a442317da3e6d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f37ec83239182c2ab3a442317da3e6d_JaffaCakes118.dll,#12⤵PID:3288
-