Analysis
-
max time kernel
93s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll
Resource
win7-20240704-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll
Resource
win10v2004-20240709-en
1 signatures
150 seconds
General
-
Target
60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll
-
Size
61KB
-
MD5
60e0c76dab80076d75d19a839aa5d840
-
SHA1
d4ffcca7cb2f886d9dc8729c9e6ae6e41f329bc0
-
SHA256
ed1e1e97ccaf598c5aa11c0b58aa78e1887b8199efd3251116573ee270472586
-
SHA512
8103a0cbd7341e1a4f84aad5b34767af14ebd9c9ab6e9ca5280443eca7d30c3e3ac8cd75638d8de427490ca53dd1268b8a7fd7c94b0f1fc6dc9b10cc5d556aeb
-
SSDEEP
768:VBhe4tujjKsBQfMKlYBOEWNBJrMZ7wADrlL1Va4AVdyjACKwbs2j+t:siax4CBhAMZ7B44e2Lj+t
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1744 wrote to memory of 4884 1744 rundll32.exe 84 PID 1744 wrote to memory of 4884 1744 rundll32.exe 84 PID 1744 wrote to memory of 4884 1744 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\60e0c76dab80076d75d19a839aa5d840_JaffaCakes118.dll,#12⤵PID:4884
-