Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 07:34
Behavioral task
behavioral1
Sample
27be3544fca0e8f3acbf33847bdfde5d_JaffaCakes118.dll
Resource
win7-20240704-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
27be3544fca0e8f3acbf33847bdfde5d_JaffaCakes118.dll
Resource
win10v2004-20240704-en
1 signatures
150 seconds
General
-
Target
27be3544fca0e8f3acbf33847bdfde5d_JaffaCakes118.dll
-
Size
82KB
-
MD5
27be3544fca0e8f3acbf33847bdfde5d
-
SHA1
f5df02bcc9666b9bd65e438eaf8b612ca4c68178
-
SHA256
cdb54b60b84bb9eb6139135637274f9d5be81670ef4da6b6a6f52715f33b260c
-
SHA512
b76028245b2796d6619822ff4aed176c32ce58b8f758fa33c0cc58320ec62f6935e3d4dc7bd1c6e02ce5a1dd7c8c8b0b61cbb724864fb51fdd7197130f1e2c40
-
SSDEEP
1536:VG3IwzRCLVHeBB2LO1b/IaSRfXrCaV4cuRACAQL:VG4wtWZLyb/Iz0aVCRkI
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2968 1424 rundll32.exe 30 PID 1424 wrote to memory of 2968 1424 rundll32.exe 30 PID 1424 wrote to memory of 2968 1424 rundll32.exe 30 PID 1424 wrote to memory of 2968 1424 rundll32.exe 30 PID 1424 wrote to memory of 2968 1424 rundll32.exe 30 PID 1424 wrote to memory of 2968 1424 rundll32.exe 30 PID 1424 wrote to memory of 2968 1424 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27be3544fca0e8f3acbf33847bdfde5d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27be3544fca0e8f3acbf33847bdfde5d_JaffaCakes118.dll,#12⤵PID:2968
-