Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23dc998d2bc0b4f174219a8d5fc39845_JaffaCakes118.dll
Resource
win7-20240220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
23dc998d2bc0b4f174219a8d5fc39845_JaffaCakes118.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
23dc998d2bc0b4f174219a8d5fc39845_JaffaCakes118.dll
-
Size
179KB
-
MD5
23dc998d2bc0b4f174219a8d5fc39845
-
SHA1
aae3c702f7020dc1f825e20017087d953151d310
-
SHA256
519fee6d1ef995a05d2984c897bc156a314f6589db74b3215202eb8d0494d45b
-
SHA512
4a208196a4802e65f273d108ca9f8b4fc64e897ba8b44d682d94edc9131e435d8a855e1094cc832c485448f9f0bcd2edff54b1e5e12a4a7ac3d528bde3f59caa
-
SSDEEP
3072:BxTDuPbum3GoVqFsraf/4O0MsWAhxBj1bqzKFD/Vv+A+kiB:VYGoVwX1oxBj1bGILVGF
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2252 2184 rundll32.exe 28 PID 2184 wrote to memory of 2252 2184 rundll32.exe 28 PID 2184 wrote to memory of 2252 2184 rundll32.exe 28 PID 2184 wrote to memory of 2252 2184 rundll32.exe 28 PID 2184 wrote to memory of 2252 2184 rundll32.exe 28 PID 2184 wrote to memory of 2252 2184 rundll32.exe 28 PID 2184 wrote to memory of 2252 2184 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\23dc998d2bc0b4f174219a8d5fc39845_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\23dc998d2bc0b4f174219a8d5fc39845_JaffaCakes118.dll,#12⤵PID:2252
-