ab0db55a30dfeb4f6c1fc0c06a18cfdc94622155a9abe5624e108c4c5b6bbf02 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:37

Sharing

Report Analysis Logs

General

Target

6950d52ac5be349ed494cddd9e372a03_JaffaCakes118.dll
Size

4KB
MD5

6950d52ac5be349ed494cddd9e372a03
SHA1

f926598b7283c838e630ba408fbcb6e39c4b32b5
SHA256

ab0db55a30dfeb4f6c1fc0c06a18cfdc94622155a9abe5624e108c4c5b6bbf02
SHA512

11a8448973208e12cbd8da902e5823203c23c419c524f82dcb836b234727c3ee63681c602eabf7e2df9228f5e2a8c4a0020560dc525511fb839edda322acd59a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2196 wrote to memory of 2792	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2792	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2792	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2792	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2792	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2792	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2792	2196	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6950d52ac5be349ed494cddd9e372a03_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6950d52ac5be349ed494cddd9e372a03_JaffaCakes118.dll,#1
2⤵
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads