Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 10:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll
Resource
win7-20240708-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll
-
Size
72KB
-
MD5
4969b055c2020c3ed0e98a389b332a3d
-
SHA1
2bfa3902590f25952c2bcc7a790326f933f21cde
-
SHA256
5746381439329d62d8d10da783b54d7e5073d964edad91da13d47a7016b2d9bc
-
SHA512
35e1c1552b506279ec96d6e6740b0f4f358601886a69dde46e7e1f8ccf1f10bbabe7c7ff241800d86c8ed0ada95eb08faf35306b97079a69d5a1adab956316b1
-
SSDEEP
1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2536 2532 rundll32.exe 30 PID 2532 wrote to memory of 2536 2532 rundll32.exe 30 PID 2532 wrote to memory of 2536 2532 rundll32.exe 30 PID 2532 wrote to memory of 2536 2532 rundll32.exe 30 PID 2532 wrote to memory of 2536 2532 rundll32.exe 30 PID 2532 wrote to memory of 2536 2532 rundll32.exe 30 PID 2532 wrote to memory of 2536 2532 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll,#12⤵PID:2536
-