Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
644e8684e4b69bbfecb0fffdde358c2f_JaffaCakes118.dll
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
644e8684e4b69bbfecb0fffdde358c2f_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
644e8684e4b69bbfecb0fffdde358c2f_JaffaCakes118.dll
-
Size
20KB
-
MD5
644e8684e4b69bbfecb0fffdde358c2f
-
SHA1
94c15e9e09eb82b201f63b442265f7341650b23d
-
SHA256
7827d1751dc44c69f614564b734a87d261906b757b81f39f8686a50eb6334af2
-
SHA512
906d50c1366bbc02709f91a075a175a31cde6c10ff5db259c80133329e8653cdce1e97ae78f27807063285ae97c13a0b25c4171067b2bcb39f8c6a0dffd39751
-
SSDEEP
384:dx++uZNUL1bQE1ysPmkDnEuV0uqXRIoa6:6+k6JbQE1ysPmkg6GRLa6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1900 2540 rundll32.exe 31 PID 2540 wrote to memory of 1900 2540 rundll32.exe 31 PID 2540 wrote to memory of 1900 2540 rundll32.exe 31 PID 2540 wrote to memory of 1900 2540 rundll32.exe 31 PID 2540 wrote to memory of 1900 2540 rundll32.exe 31 PID 2540 wrote to memory of 1900 2540 rundll32.exe 31 PID 2540 wrote to memory of 1900 2540 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\644e8684e4b69bbfecb0fffdde358c2f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\644e8684e4b69bbfecb0fffdde358c2f_JaffaCakes118.dll,#12⤵PID:1900
-