Analysis
-
max time kernel
94s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c708728a6e2a2840a0bb86a218dc2f4_JaffaCakes118.dll
Resource
win7-20240704-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c708728a6e2a2840a0bb86a218dc2f4_JaffaCakes118.dll
Resource
win10v2004-20240709-en
1 signatures
150 seconds
General
-
Target
4c708728a6e2a2840a0bb86a218dc2f4_JaffaCakes118.dll
-
Size
52KB
-
MD5
4c708728a6e2a2840a0bb86a218dc2f4
-
SHA1
98d0426df148319bfcc6c8028864fef9251bd540
-
SHA256
59c9399f2aeb8e73fc6c0f463dc2a968b30a5ff7099caf037a9ef50035bbdb5a
-
SHA512
e253b1d53cdc70275cc4477115edbce4cef7bb4339afeed6b04ebf047c610c810ece68815805ba071190f79e7f5923e34dccd5facd3c0acabe2396ab5148ea28
-
SSDEEP
1536:bYWP7HA0eFQw3qtN8tGqLssrgEBy/tsuA:LHA0peqtN8w4rgEBx
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 836 wrote to memory of 1860 836 rundll32.exe 83 PID 836 wrote to memory of 1860 836 rundll32.exe 83 PID 836 wrote to memory of 1860 836 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4c708728a6e2a2840a0bb86a218dc2f4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4c708728a6e2a2840a0bb86a218dc2f4_JaffaCakes118.dll,#12⤵PID:1860
-