Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll
-
Size
16KB
-
MD5
3662a15bfadbe2e698ab88b63df78417
-
SHA1
7767c9cdd351621ca33bc035d96629a58e91c29b
-
SHA256
fc39049c2e5c8b1a024026510a738361d1cd0c05b588257f198404e8e4ccb618
-
SHA512
6e48885ec1401d617c9100eeb28f7a5c89cdb2182311582e90d941ba115de696df407e5392d4598c1b816343a26d693b2c911eee312f39fcce4f6e7be79e682a
-
SSDEEP
384:d3f7aeX+JaBq/DtXnWLUypkMagvuBNUC0x6h3aG+9lUXTYpxspM:oeX+JG9U5MagvMT0x6polxsi
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 528 wrote to memory of 4928 528 rundll32.exe rundll32.exe PID 528 wrote to memory of 4928 528 rundll32.exe rundll32.exe PID 528 wrote to memory of 4928 528 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3662a15bfadbe2e698ab88b63df78417_JaffaCakes118.dll,#12⤵PID:4928