ec223e046c5f1631ad3e072add00d01f39066655b731748196e071f903f598c6 | Triage

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 03:51

Sharing

Report Analysis Logs

General

Target

0c6200aeda5a760a042283643f4005a8_JaffaCakes118.dll
Size

48KB
MD5

0c6200aeda5a760a042283643f4005a8
SHA1

a62e27794d7b54edc6ba4fc399b12dad755c8a3e
SHA256

ec223e046c5f1631ad3e072add00d01f39066655b731748196e071f903f598c6
SHA512

a16b2837486f4ae50c87225baafe326f9ef6bd0f256cb09d5fccb69bff28e8e26347de0628467cb368f1da0657e7b67c607f1b28d19554f48185f2f49628621c
SSDEEP

768:0RZUg+W04e2birpH883JWLcVd5NypJzXo9:0RZBbildZVEHbo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1696	1604	rundll32.exe	81
PID 1604 wrote to memory of 1696	1604	rundll32.exe	81
PID 1604 wrote to memory of 1696	1604	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c6200aeda5a760a042283643f4005a8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c6200aeda5a760a042283643f4005a8_JaffaCakes118.dll,#1
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-0-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/1696-1-0x0000000002D00000-0x0000000002DD6000-memory.dmp

Filesize
856KB

Download
memory/1696-2-0x0000000002D00000-0x0000000002DD6000-memory.dmp

Filesize
856KB

Download