178bc18901ee6ee0f44109d780098c716fe430991de5647ba9a31e11d2143e94 | Triage

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 23:11

Sharing

Report Analysis Logs

General

Target

f223ef9e8fa91ea832bbe5c8c5feab5d_JaffaCakes118.dll
Size

30KB
MD5

f223ef9e8fa91ea832bbe5c8c5feab5d
SHA1

b5447dde34783092ad422e975996e93d1da932cf
SHA256

178bc18901ee6ee0f44109d780098c716fe430991de5647ba9a31e11d2143e94
SHA512

80fa2cbbe133ba3c5a6a80d7c857f2f47566d46c8a14ad0a3ff86b1af283f5ce03fa80571956687ffe2cc5c0108ae7f98be5461d75903cd7461f108eb15f6db0
SSDEEP

768:P51NHykUnpPbkChqZndkH1DQ8tPf0vF6:PnkkUtk+qec8ct6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2184	2680	rundll32.exe	85
PID 2680 wrote to memory of 2184	2680	rundll32.exe	85
PID 2680 wrote to memory of 2184	2680	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f223ef9e8fa91ea832bbe5c8c5feab5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f223ef9e8fa91ea832bbe5c8c5feab5d_JaffaCakes118.dll,#1
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download