d4d283b00de789b6d1ba87c71f9c54a0491a6b5daf923cadfee8faf383aa1687 | Triage

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 10:21

Sharing

Report Analysis Logs

General

Target

15a3919fc97d0edf07af1aba60df8e3e_JaffaCakes118.dll
Size

848KB
MD5

15a3919fc97d0edf07af1aba60df8e3e
SHA1

868f618536cbe0f7aff9e33b1d1d84db6bfd048d
SHA256

d4d283b00de789b6d1ba87c71f9c54a0491a6b5daf923cadfee8faf383aa1687
SHA512

235bce742adae63028ba13f08fc57fe707c8898995203203bc00a457ae7f8ba539f7248b296c8a9dc1bb84cd15acc66510603862ee43d3c37e51aad86f276e66
SSDEEP

24576:hS3Ur3ZvLAvi5fygzaaL/LF6tJSyrane32v:hVXFJ5Y2

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 628	3080	rundll32.exe	81
PID 3080 wrote to memory of 628	3080	rundll32.exe	81
PID 3080 wrote to memory of 628	3080	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15a3919fc97d0edf07af1aba60df8e3e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15a3919fc97d0edf07af1aba60df8e3e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads