1d413b1d441f826708e14a2fc6a9a5b6ccc5977b29edfb8e90a0bf168795d928 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f8034335d78de8acb5ba03080ba59814_JaffaCakes118.dll
Size

35KB
MD5

f8034335d78de8acb5ba03080ba59814
SHA1

6651d5f500aea1a9df9b92904992b97dd04e76e3
SHA256

1d413b1d441f826708e14a2fc6a9a5b6ccc5977b29edfb8e90a0bf168795d928
SHA512

5b3746fab76b19a42edfbdc42972d6b6c824e00e3ef342a8d1c3ade535760b434d1bcb26c84e949c8f893bb6269cda97212711d10ade9663ea5d610ab26d7822
SSDEEP

768:9s81AwPVa0dl67oGmXrySJQqMMB4cVq5s:9jnbAY7LQn05q5s

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2360	2388	rundll32.exe	28
PID 2388 wrote to memory of 2360	2388	rundll32.exe	28
PID 2388 wrote to memory of 2360	2388	rundll32.exe	28
PID 2388 wrote to memory of 2360	2388	rundll32.exe	28
PID 2388 wrote to memory of 2360	2388	rundll32.exe	28
PID 2388 wrote to memory of 2360	2388	rundll32.exe	28
PID 2388 wrote to memory of 2360	2388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8034335d78de8acb5ba03080ba59814_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8034335d78de8acb5ba03080ba59814_JaffaCakes118.dll,#1
  2⤵
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-0-0x00000000000D0000-0x00000000000DF000-memory.dmp

Filesize
60KB

Download