Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 08:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll
Resource
win7-20240708-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll
-
Size
7KB
-
MD5
628e61477c1d785d91cee044a81e32a0
-
SHA1
20ee2e15cbcd16a1f21dc5b0adc7f99a16505ca2
-
SHA256
5c1b068ed054fe665d36a9d0ee6cc4ab8b6e5e8983d7c2a706426753ff2fbd72
-
SHA512
18503f7978d8632e02560c6250a7fd3553dbcfac00f4d2b5ee2d55b9fed1e72fc48a90e1fa4094ed04216b7c7fd0d5fdffbc89ec6658c87df3c47fa092b8cfd3
-
SSDEEP
96:HmqT1Ue9tHz5TSZPmAEdjY7ZosmOLEafhEctHSN:GqT1Ue1TSZP2duoWLL+TN
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2332 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2332 2328 rundll32.exe 31 PID 2328 wrote to memory of 2332 2328 rundll32.exe 31 PID 2328 wrote to memory of 2332 2328 rundll32.exe 31 PID 2328 wrote to memory of 2332 2328 rundll32.exe 31 PID 2328 wrote to memory of 2332 2328 rundll32.exe 31 PID 2328 wrote to memory of 2332 2328 rundll32.exe 31 PID 2328 wrote to memory of 2332 2328 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\628e61477c1d785d91cee044a81e32a0_JaffaCakes118.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2332
-