Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 02:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a26b4b18e5531001c176c04e2dad024_JaffaCakes118.dll
Resource
win7-20240705-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a26b4b18e5531001c176c04e2dad024_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
5a26b4b18e5531001c176c04e2dad024_JaffaCakes118.dll
-
Size
32KB
-
MD5
5a26b4b18e5531001c176c04e2dad024
-
SHA1
d51dd8d3d4b493c79fda9eaa10ee72388e255426
-
SHA256
3d7e507c7db240372934f26bcb5d966206b5009939412f525e5079cfff221f46
-
SHA512
0de0828419a03105f326b787c8e01a6dde6086e1208bce00220301c63fc2c0025278451d12497d3e1969883b313deefdc72046e66705a89586143f8f0e3e83a0
-
SSDEEP
192:u0hC7dehzrKzOl+za7uerDho6y/fV3u8u514skIVFPaOFPWk1vMTP+4U/Tnb:pYdONl++hrDh2u8ubrTVVWk1v4P+4cT
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2028 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2028 2052 rundll32.exe 31 PID 2052 wrote to memory of 2028 2052 rundll32.exe 31 PID 2052 wrote to memory of 2028 2052 rundll32.exe 31 PID 2052 wrote to memory of 2028 2052 rundll32.exe 31 PID 2052 wrote to memory of 2028 2052 rundll32.exe 31 PID 2052 wrote to memory of 2028 2052 rundll32.exe 31 PID 2052 wrote to memory of 2028 2052 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a26b4b18e5531001c176c04e2dad024_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a26b4b18e5531001c176c04e2dad024_JaffaCakes118.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2028
-