Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 23:13
Static task
static1
Behavioral task
behavioral1
Sample
605e510079a97c76fb6923183d16589c_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
605e510079a97c76fb6923183d16589c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
605e510079a97c76fb6923183d16589c_JaffaCakes118.dll
-
Size
58KB
-
MD5
605e510079a97c76fb6923183d16589c
-
SHA1
e3bda6420cf761a8e45bc02a38de022f4f179f57
-
SHA256
bbb7109c5426b1e62357f7d11b519207d24b87c1d26c0e71bc4dc40a2f2d1630
-
SHA512
4bcbd44c75784ada5713d995bff56583362292a4eecc1821e3797ccf3dd82e1d6b67b3289184cc0c96808d85bb933883d1107ff3feec7e937bb424bf291d63aa
-
SSDEEP
768:ki6aw3i+9FPokTviMec1gp3nEPmRPy9EmaUSfassO+wcSDPnGMEa4:9x+9FHiH3nBPy9YfIGDvlEP
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4808 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4292 wrote to memory of 4808 4292 rundll32.exe 84 PID 4292 wrote to memory of 4808 4292 rundll32.exe 84 PID 4292 wrote to memory of 4808 4292 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\605e510079a97c76fb6923183d16589c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\605e510079a97c76fb6923183d16589c_JaffaCakes118.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:4808
-