5a0084c15983e072e4239245a81b56625207671d9f88cb2ec13dcab64e8e7d79 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 11:37

Sharing

Report Analysis Logs

General

Target

084926bf3817021c95715ae5e38d2e10_JaffaCakes118.dll
Size

8KB
MD5

084926bf3817021c95715ae5e38d2e10
SHA1

39aebe68979366f419096fbd4844bdf98519c6a7
SHA256

5a0084c15983e072e4239245a81b56625207671d9f88cb2ec13dcab64e8e7d79
SHA512

a7ddd207de3f2b980662757c33733bc333c68d4e88c07357b3af33780bde4aa97c3ab0aaff0bc16742739e09aff7112a311d7007ceb5fb60a979726d9bad6dbd
SSDEEP

192:zcGnooFctM5rAkB4AjHUuEpgr4/euiQed:zVRd1Tcg8Ydd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2924	2136	rundll32.exe	28
PID 2136 wrote to memory of 2924	2136	rundll32.exe	28
PID 2136 wrote to memory of 2924	2136	rundll32.exe	28
PID 2136 wrote to memory of 2924	2136	rundll32.exe	28
PID 2136 wrote to memory of 2924	2136	rundll32.exe	28
PID 2136 wrote to memory of 2924	2136	rundll32.exe	28
PID 2136 wrote to memory of 2924	2136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\084926bf3817021c95715ae5e38d2e10_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\084926bf3817021c95715ae5e38d2e10_JaffaCakes118.dll,#1
  2⤵
  PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads