Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36666caddabf2bf488b8924924e33db3_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
36666caddabf2bf488b8924924e33db3_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
36666caddabf2bf488b8924924e33db3_JaffaCakes118.dll
-
Size
113KB
-
MD5
36666caddabf2bf488b8924924e33db3
-
SHA1
7b14c374825c58d85c690da3129e04e7bc4b1109
-
SHA256
11e8f8a82f4bf7d81559c7afdc6fc7462ae820dadf11ed811acf973a145f5113
-
SHA512
a7a06c9b1570466ba14fd4cd0f6be7745dc41680d789d64d84da1705e7beb104eb935775b8177b6ea365c233ecc0fb35f3fb521367f50edba7ba4684d40afabc
-
SSDEEP
3072:uWD6In9QPsSLmfcso6LjSGMH2d+y94lgsdM9Ys/:uSdkPsXPS1y9Iu/
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4648 5076 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4572 wrote to memory of 5076 4572 rundll32.exe rundll32.exe PID 4572 wrote to memory of 5076 4572 rundll32.exe rundll32.exe PID 4572 wrote to memory of 5076 4572 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36666caddabf2bf488b8924924e33db3_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36666caddabf2bf488b8924924e33db3_JaffaCakes118.dll,#12⤵PID:5076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 6363⤵
- Program crash
PID:4648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5076 -ip 50761⤵PID:2648