58f42f7e3005b33be5ccb8ccb4cd029a3823c2e22de4bc936ceb20fd19de1ec6 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 11:20

Sharing

Report Analysis Logs

General

Target

0584e75c78d1c592c4f0a656f7c86417_JaffaCakes118.dll
Size

3KB
MD5

0584e75c78d1c592c4f0a656f7c86417
SHA1

830407b95490b3da0515cae28aa7209b3c04e687
SHA256

58f42f7e3005b33be5ccb8ccb4cd029a3823c2e22de4bc936ceb20fd19de1ec6
SHA512

2ef8643eee58f689f2e849871aa3baaeb01ebd8966ee662f6179367ebc456d263a05e2770be6519d62a171f5f9f4acf492eea0cdbc3aabf2dc674beba7628462

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1204	2360	rundll32.exe	28
PID 2360 wrote to memory of 1204	2360	rundll32.exe	28
PID 2360 wrote to memory of 1204	2360	rundll32.exe	28
PID 2360 wrote to memory of 1204	2360	rundll32.exe	28
PID 2360 wrote to memory of 1204	2360	rundll32.exe	28
PID 2360 wrote to memory of 1204	2360	rundll32.exe	28
PID 2360 wrote to memory of 1204	2360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0584e75c78d1c592c4f0a656f7c86417_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0584e75c78d1c592c4f0a656f7c86417_JaffaCakes118.dll,#1
  2⤵
  PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads