Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
433a96efc9b21eb8d5828e3075b71840_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
433a96efc9b21eb8d5828e3075b71840_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
433a96efc9b21eb8d5828e3075b71840_JaffaCakes118.dll
-
Size
86KB
-
MD5
433a96efc9b21eb8d5828e3075b71840
-
SHA1
1f3458db700ee6cda90c49a287ac66e5469af822
-
SHA256
01f344adffc74824f5a4060ee6aeb3e9f12e7098638e320bac78a6b931ae8505
-
SHA512
c3fceb3631e76a5ee31e1722f6a8d3c50a9efce7d2d2cde3fc9a5800b99a9adad14ced7b2f1750d3e324e6c988f98df8cc4b177d3387a4981329dadc81d16684
-
SSDEEP
1536:o7Wo/iiKhqDLEqSn85fyqg4AfcQGavuGTM8vhWBlq0EMlFtBkM0YO:o7Wzhrn8FgfZ9MjdZVK
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2760 2708 rundll32.exe 31 PID 2708 wrote to memory of 2760 2708 rundll32.exe 31 PID 2708 wrote to memory of 2760 2708 rundll32.exe 31 PID 2708 wrote to memory of 2760 2708 rundll32.exe 31 PID 2708 wrote to memory of 2760 2708 rundll32.exe 31 PID 2708 wrote to memory of 2760 2708 rundll32.exe 31 PID 2708 wrote to memory of 2760 2708 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\433a96efc9b21eb8d5828e3075b71840_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\433a96efc9b21eb8d5828e3075b71840_JaffaCakes118.dll,#12⤵PID:2760
-