92966d2cdbab9a87c7fa51f4bb0a8c33c2a68059b18bb64599ca1ddb1a5a606c | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 23:48

Sharing

Report Analysis Logs

General

Target

4d9c51141f34aeb5a763753068c4cf8f_JaffaCakes118.dll
Size

4KB
MD5

4d9c51141f34aeb5a763753068c4cf8f
SHA1

cbd058cbc18d1f262ed7f38b173deab4c5f53b21
SHA256

92966d2cdbab9a87c7fa51f4bb0a8c33c2a68059b18bb64599ca1ddb1a5a606c
SHA512

7dfc28f232d325fba26719645f37e02fb077fea3d5b52efddb7f277e4ce693371d239474543bff9e4ab1c88bc69cc351ab979d2340da738d52185baf884d6743

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1848	1680	rundll32.exe	28
PID 1680 wrote to memory of 1848	1680	rundll32.exe	28
PID 1680 wrote to memory of 1848	1680	rundll32.exe	28
PID 1680 wrote to memory of 1848	1680	rundll32.exe	28
PID 1680 wrote to memory of 1848	1680	rundll32.exe	28
PID 1680 wrote to memory of 1848	1680	rundll32.exe	28
PID 1680 wrote to memory of 1848	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d9c51141f34aeb5a763753068c4cf8f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d9c51141f34aeb5a763753068c4cf8f_JaffaCakes118.dll,#1
  2⤵
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads