Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 15:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cce79f55d9ef46d98fb7ad2a7acc0da_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2cce79f55d9ef46d98fb7ad2a7acc0da_JaffaCakes118.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2cce79f55d9ef46d98fb7ad2a7acc0da_JaffaCakes118.dll
-
Size
13KB
-
MD5
2cce79f55d9ef46d98fb7ad2a7acc0da
-
SHA1
658d45fe3bdc93ab7e44c031c9de63571998a1ca
-
SHA256
0e2d1bb0307b14a5ff080b1571ef96445c56f50c7f87c218244cdc5469be3fee
-
SHA512
f8011a9d2ace2f14654de3d6cf05893c54f9bde75f911114725438e4ae3403e3d4be03534fe9bbae07d8eaf7d6bfbaea2f63143164cff0921c547aace7ae7a31
-
SSDEEP
384:cDGaLDNc4q4yLYfuSfvX8WfhGs5VYpAmmtGxYcfFY:cCWZc4B4aP7cvpA8ecG
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4512 2432 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2432 1120 rundll32.exe 82 PID 1120 wrote to memory of 2432 1120 rundll32.exe 82 PID 1120 wrote to memory of 2432 1120 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2cce79f55d9ef46d98fb7ad2a7acc0da_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2cce79f55d9ef46d98fb7ad2a7acc0da_JaffaCakes118.dll,#12⤵PID:2432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 5483⤵
- Program crash
PID:4512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2432 -ip 24321⤵PID:3052