Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll
Resource
win7-20240704-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll
-
Size
307KB
-
MD5
32990fc7ef82f24a56dc0d263618a102
-
SHA1
9748866ba26d76d11cb46667fb4fcf84d770bf3c
-
SHA256
6033322a9da7db8282cd9602bd1aee1ca8f5cdc2ce0afecc0222849ce6793c87
-
SHA512
f444e037b82c123efb6da3f42b7537993cb5485d3c031c23cb06120d78b81420c4ad85d9c5a52a513e5f50ffbd18117ce8eb01dea1dbc4895bea28fba3258049
-
SSDEEP
6144:m+FLMJGJnjOy5HIY74Socz7uH2KnFYZYY40+aLXRvl2OhpbifnZglGi:maLMaOy5oY7LlziH2zm0R5gOh5YZgz
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4552 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4552 3136 rundll32.exe 81 PID 3136 wrote to memory of 4552 3136 rundll32.exe 81 PID 3136 wrote to memory of 4552 3136 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32990fc7ef82f24a56dc0d263618a102_JaffaCakes118.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:4552
-