Analysis
-
max time kernel
13s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 15:24
Behavioral task
behavioral1
Sample
39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll
-
Size
88KB
-
MD5
39af2dc0194618e8e6553570d4139aac
-
SHA1
7b682f99016023803c7dac6c7e7b8b2be2ea11b0
-
SHA256
810334b1ab32c522aacd0f2313e3c5cead2b4bb66fa1c2f3c7cfe8a73f9a001d
-
SHA512
c980444a658d056b221e4a964e01b4efff34636aad5fc0ac371e08d8fb97fc41f462a18fc3f9c94e684106271449ee3e365e5c4a2209a73c594583ed6f722a64
-
SSDEEP
1536:J3iyDPFw2bprmjUmq1AnNkc0tyUc/+XFbJ9dq16V:1Tw2bpCK1AnNn0t92+VbDdq16V
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1100-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1100 2552 rundll32.exe 29 PID 2552 wrote to memory of 1100 2552 rundll32.exe 29 PID 2552 wrote to memory of 1100 2552 rundll32.exe 29 PID 2552 wrote to memory of 1100 2552 rundll32.exe 29 PID 2552 wrote to memory of 1100 2552 rundll32.exe 29 PID 2552 wrote to memory of 1100 2552 rundll32.exe 29 PID 2552 wrote to memory of 1100 2552 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll,#12⤵PID:1100
-