Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll
-
Size
16KB
-
MD5
3662a15bfadbe2e698ab88b63df78417
-
SHA1
7767c9cdd351621ca33bc035d96629a58e91c29b
-
SHA256
fc39049c2e5c8b1a024026510a738361d1cd0c05b588257f198404e8e4ccb618
-
SHA512
6e48885ec1401d617c9100eeb28f7a5c89cdb2182311582e90d941ba115de696df407e5392d4598c1b816343a26d693b2c911eee312f39fcce4f6e7be79e682a
-
SSDEEP
384:d3f7aeX+JaBq/DtXnWLUypkMagvuBNUC0x6h3aG+9lUXTYpxspM:oeX+JG9U5MagvMT0x6polxsi
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2320 1808 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 780 wrote to memory of 1808 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1808 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1808 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1808 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1808 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1808 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1808 780 rundll32.exe rundll32.exe PID 1808 wrote to memory of 2320 1808 rundll32.exe WerFault.exe PID 1808 wrote to memory of 2320 1808 rundll32.exe WerFault.exe PID 1808 wrote to memory of 2320 1808 rundll32.exe WerFault.exe PID 1808 wrote to memory of 2320 1808 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 2363⤵
- Program crash
PID:2320