3ec83fd997af24625c917d11e3f2b45d75f9fad122cb0efddd82fbe27ec9c127 | Triage

Analysis

max time kernel
108s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa3a8f6a9f95d1c7050b627882cbf5ab_JaffaCakes118.dll
Size

3KB
MD5

fa3a8f6a9f95d1c7050b627882cbf5ab
SHA1

ff5afa612e6b327a5beabed972aca01e6ec26dc0
SHA256

3ec83fd997af24625c917d11e3f2b45d75f9fad122cb0efddd82fbe27ec9c127
SHA512

da5951ed4fd32bfdae227cc978dddfc7052a7f2ab17960f7c4d9a79ce6b7212b9eb3017053acb1649bb576cf37ab9aac0c862bf9d3ca8fe7936926b8c99e918a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1136	376	rundll32.exe	85
PID 376 wrote to memory of 1136	376	rundll32.exe	85
PID 376 wrote to memory of 1136	376	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa3a8f6a9f95d1c7050b627882cbf5ab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa3a8f6a9f95d1c7050b627882cbf5ab_JaffaCakes118.dll,#1
  2⤵
  PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads