b454e5704780a863b54ca815fe63a2a32de85f6554ded9d8bea0a7ca4a3e3f9a | Triage

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 05:18

Sharing

Report Analysis Logs

General

Target

2131e33ba6429187dde4bfdd5833208d_JaffaCakes118.dll
Size

3KB
MD5

2131e33ba6429187dde4bfdd5833208d
SHA1

6040221f4991791bea279da83ec70c90958c82ad
SHA256

b454e5704780a863b54ca815fe63a2a32de85f6554ded9d8bea0a7ca4a3e3f9a
SHA512

102378d2a4fdd427af5e07054e5942db6ff2b954eab00a45c8925ef8908daa99e3bb02dbbc50ace118993ba3717a48c12ccfcb1326d908bf341d299ce6b24810

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4212	2040	rundll32.exe	83
PID 2040 wrote to memory of 4212	2040	rundll32.exe	83
PID 2040 wrote to memory of 4212	2040	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2131e33ba6429187dde4bfdd5833208d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2131e33ba6429187dde4bfdd5833208d_JaffaCakes118.dll,#1
  2⤵
  PID:4212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads