Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 07:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a85c7ee37e30785b04d7f80b975302b_JaffaCakes118.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a85c7ee37e30785b04d7f80b975302b_JaffaCakes118.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1a85c7ee37e30785b04d7f80b975302b_JaffaCakes118.dll
-
Size
16KB
-
MD5
1a85c7ee37e30785b04d7f80b975302b
-
SHA1
f75d9768058f80adecf50be3d806dc8613e60d9f
-
SHA256
25ea0ccd22727afd32e42c4f265c4f0d37c6b1aa62ac93b16e43a8f81da63ee0
-
SHA512
77c74034349e343e8de00950adec3b753faf80202ca9c4a12e9ce30c5a02bf36b02c4331a66aed9056df8b27a2147a3e32ac1a0a0fb3faee2d575c997f98f461
-
SSDEEP
384:vWwXvOow297UixaRCjnmin/tw4Hmvhg5PRi:vDOoxUixacjnh/twqmveLi
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2204 2176 rundll32.exe 28 PID 2176 wrote to memory of 2204 2176 rundll32.exe 28 PID 2176 wrote to memory of 2204 2176 rundll32.exe 28 PID 2176 wrote to memory of 2204 2176 rundll32.exe 28 PID 2176 wrote to memory of 2204 2176 rundll32.exe 28 PID 2176 wrote to memory of 2204 2176 rundll32.exe 28 PID 2176 wrote to memory of 2204 2176 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a85c7ee37e30785b04d7f80b975302b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a85c7ee37e30785b04d7f80b975302b_JaffaCakes118.dll,#12⤵PID:2204
-