6a0ca9cbc362adbfd6a844730f02e35a960835bbb9aef1a4ea460ec6bd1e6164 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 14:58

Sharing

Report Analysis Logs

General

Target

10ca2c1c205cca300fddcc6c2e39fcd3_JaffaCakes118.dll
Size

16KB
MD5

10ca2c1c205cca300fddcc6c2e39fcd3
SHA1

88249eab645b1721d2e27e36842b6cce484c2f16
SHA256

6a0ca9cbc362adbfd6a844730f02e35a960835bbb9aef1a4ea460ec6bd1e6164
SHA512

c13c294e78eb7b96beb0a9af23bffb54028deedbf333409f164de395389ad685cfba01c984a77d7b1bc71664370071c59cd7fd863709db0c24fdfce6b689eea7
SSDEEP

384:NAFIoCGZeqKWGjB6pxX4LFnLSFj60Meyx8q:NA0y5q6pWhnm1r

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10ca2c1c205cca300fddcc6c2e39fcd3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10ca2c1c205cca300fddcc6c2e39fcd3_JaffaCakes118.dll,#1
  2⤵
  PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads