1ef214cb4d9913afec16ff402657ab6aa6a0b4aef28e5481a6d68b95a661f673 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 07:06

Sharing

Report Analysis Logs

General

Target

03e3666485e25d52c52d4a4e4d280cc8_JaffaCakes118.dll
Size

26KB
MD5

03e3666485e25d52c52d4a4e4d280cc8
SHA1

443848decdc63e22afe054d766dca96608d01be5
SHA256

1ef214cb4d9913afec16ff402657ab6aa6a0b4aef28e5481a6d68b95a661f673
SHA512

b1e506f8ff9f9aca32a86ce4133ce42143d84c22898d1be76571eb2feab04891b2029e64cb1feeb4da42077aa870685170951060d100365cf9852f932e12bcc1
SSDEEP

768:oa1c4/lzhgxWpqsH9MVKRDQG90sNIsrS:osjVduKVQGT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1124	828	rundll32.exe	28
PID 828 wrote to memory of 1124	828	rundll32.exe	28
PID 828 wrote to memory of 1124	828	rundll32.exe	28
PID 828 wrote to memory of 1124	828	rundll32.exe	28
PID 828 wrote to memory of 1124	828	rundll32.exe	28
PID 828 wrote to memory of 1124	828	rundll32.exe	28
PID 828 wrote to memory of 1124	828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03e3666485e25d52c52d4a4e4d280cc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03e3666485e25d52c52d4a4e4d280cc8_JaffaCakes118.dll,#1
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads