107d3a53aed7994a2bcd95b8181ecb99667a04f42831f5bf873d49d942b1a78a | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:26

Sharing

Report Analysis Logs

General

Target

6948831036a80cb9abf462751a9e2de4_JaffaCakes118.dll
Size

509KB
MD5

6948831036a80cb9abf462751a9e2de4
SHA1

e0c2830fa9f8c291956cabfc4341ecda0630c817
SHA256

107d3a53aed7994a2bcd95b8181ecb99667a04f42831f5bf873d49d942b1a78a
SHA512

ef07234b7784e2c77bbde085794eef75f5185f72fe20087089722197dd9bdf30ef73b6287bbaf5899694322aff3493bda3ff08fac6a2a476f86a93b8b0209117
SSDEEP

12288:LSXIozWkPOLgUVsbIcDuexEOXCigSNOtRlN2:L9LLVYX/aE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 2660	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2660	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2660	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2660	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2660	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2660	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2660	1944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6948831036a80cb9abf462751a9e2de4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6948831036a80cb9abf462751a9e2de4_JaffaCakes118.dll,#1
2⤵
PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads