e09dd0cc3b7b26a2286957fe70e8cbf09f7d80a7b4fc6cec2ea966e20e5611bf | Triage

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 11:04

Sharing

Report Analysis Logs

General

Target

f35b2e0ba915cfeccb657e3c6f98a8ba_JaffaCakes118.dll
Size

25KB
MD5

f35b2e0ba915cfeccb657e3c6f98a8ba
SHA1

0fd86f52ac93d56591f479e96645caec2716c10d
SHA256

e09dd0cc3b7b26a2286957fe70e8cbf09f7d80a7b4fc6cec2ea966e20e5611bf
SHA512

608e794091a29069a2a2b46940007bb73926d5f05c346fbc8d333ede02b135555dd7d895a358a2cdb957655dc94a145094c5fbd3232b54e9838db49f4bed2e21
SSDEEP

768:uYgQlevpDiSK6pX9B6U9E0G6xEpYHFSFq:lleh9KWHVKJFq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28
PID 2028 wrote to memory of 2656	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f35b2e0ba915cfeccb657e3c6f98a8ba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f35b2e0ba915cfeccb657e3c6f98a8ba_JaffaCakes118.dll,#1
  2⤵
  PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2656-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download