3e987f2505da7ddc77d206ac8a7cea86697fc5dfcfb6673ff08b25f2946f39df | Triage™

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a76fbb2a878893b41f70962073fbdcca_JaffaCakes118.dll
Size 4KB
Sample240614-bc4scasdqq
SHA256 3e987f2505da7ddc77d206ac8a7cea86697fc5dfcfb6673ff08b25f2946f39df
MD5 a76fbb2a878893b41f70962073fbdcca
SHA1 0b58c21bfd06866365b7e423173fa1e170f4474b
SHA512 2d6ec27db4323a7c15b9263b9c021afa11c8340f0f005748e1978a03e1021977647afcb085dfcf41c06277d7faf0078e8211acf0f4f3a1c08901039f666774b7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3812	1076	rundll32.exe	81
PID 1076 wrote to memory of 3812	1076	rundll32.exe	81
PID 1076 wrote to memory of 3812	1076	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a76fbb2a878893b41f70962073fbdcca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a76fbb2a878893b41f70962073fbdcca_JaffaCakes118.dll,#1
  2⤵
  PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads