Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2025, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_b2f64e82274878225a7579ad17c2ce1e.dll
Resource
win10v2004-20250410-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
JaffaCakes118_b2f64e82274878225a7579ad17c2ce1e.dll
-
Size
10.2MB
-
MD5
b2f64e82274878225a7579ad17c2ce1e
-
SHA1
b8d8c264913e5a24f14c4c4bd3e1a19d71956f68
-
SHA256
cd7e711b46b0fd4b9861a27fa9d9a8f3df360fb3e33501beb032e38f3c52ad4c
-
SHA512
c723cdd62b0c262dff6f22c978f736338f23732bc29ae0784a77385bea8ecca42c14488a3e714be352f5cb69b18246a5a7aba4abe2cab77dec00f827b89a8f18
-
SSDEEP
6144:Y87eZ91crGeIAjGq0Uc87eZ91crGeIAjGq0Uz:Y8yDu/DoB8yDu/DoQ
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe 2656 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2656 1948 rundll32.exe 83 PID 1948 wrote to memory of 2656 1948 rundll32.exe 83 PID 1948 wrote to memory of 2656 1948 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2f64e82274878225a7579ad17c2ce1e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2f64e82274878225a7579ad17c2ce1e.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2656
-