Analysis
-
max time kernel
92s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 17:19
Static task
static1
Behavioral task
behavioral1
Sample
2d2e2be000162ab54b2a7c9a0d0728de_JaffaCakes118.dll
Resource
win7-20240705-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d2e2be000162ab54b2a7c9a0d0728de_JaffaCakes118.dll
Resource
win10v2004-20240704-en
1 signatures
150 seconds
General
-
Target
2d2e2be000162ab54b2a7c9a0d0728de_JaffaCakes118.dll
-
Size
346KB
-
MD5
2d2e2be000162ab54b2a7c9a0d0728de
-
SHA1
56705f20f239ded6d0363b71af0d6bc064513c5a
-
SHA256
c0eefbc8e6214fee930be7f3614bb17dba52afc3d8085a8ce7c56e3e995fa49a
-
SHA512
465deb29cd0c5738393eb3d0170a39743235d84c8da65ae5ed42439162fbb5eefbf7b75ecfc807627e1f466cd93230a5254e9203ae08030a34e1951a9f730b69
-
SSDEEP
3072:082jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:v2L7HN7Kl/jLA90QECrYRpj
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 632 wrote to memory of 2068 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 2068 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 2068 632 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2e2be000162ab54b2a7c9a0d0728de_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2e2be000162ab54b2a7c9a0d0728de_JaffaCakes118.dll,#12⤵PID:2068