d4d283b00de789b6d1ba87c71f9c54a0491a6b5daf923cadfee8faf383aa1687 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 10:21

Sharing

Report Analysis Logs

General

Target

15a3919fc97d0edf07af1aba60df8e3e_JaffaCakes118.dll
Size

848KB
MD5

15a3919fc97d0edf07af1aba60df8e3e
SHA1

868f618536cbe0f7aff9e33b1d1d84db6bfd048d
SHA256

d4d283b00de789b6d1ba87c71f9c54a0491a6b5daf923cadfee8faf383aa1687
SHA512

235bce742adae63028ba13f08fc57fe707c8898995203203bc00a457ae7f8ba539f7248b296c8a9dc1bb84cd15acc66510603862ee43d3c37e51aad86f276e66
SSDEEP

24576:hS3Ur3ZvLAvi5fygzaaL/LF6tJSyrane32v:hVXFJ5Y2

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2836	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15a3919fc97d0edf07af1aba60df8e3e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15a3919fc97d0edf07af1aba60df8e3e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads