1846331398a25c966a78ca98f0ca642d415bce1c926f82c8b5414d67465f7534 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 01:34

Sharing

Report Analysis Logs

General

Target

242d7aac81aaf4d6e21eac60d6b87b6d_JaffaCakes118.dll
Size

28KB
MD5

242d7aac81aaf4d6e21eac60d6b87b6d
SHA1

2a7c0b03534ad29fce284191ee40a5f35655052b
SHA256

1846331398a25c966a78ca98f0ca642d415bce1c926f82c8b5414d67465f7534
SHA512

145d4978bb148f523d129c07eb04a869800645978ee08fe9d1e04cfea66082852e7722d40e70e60750bb64ac44f514f77d2cca5a985bd0b60ab2f83cc1303ba5
SSDEEP

768:YXT7vpkDoIC307nO/sD425rlh6fZyhIZAY:YD7RkFa+4qG0e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2980	2792	rundll32.exe	28
PID 2792 wrote to memory of 2980	2792	rundll32.exe	28
PID 2792 wrote to memory of 2980	2792	rundll32.exe	28
PID 2792 wrote to memory of 2980	2792	rundll32.exe	28
PID 2792 wrote to memory of 2980	2792	rundll32.exe	28
PID 2792 wrote to memory of 2980	2792	rundll32.exe	28
PID 2792 wrote to memory of 2980	2792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\242d7aac81aaf4d6e21eac60d6b87b6d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\242d7aac81aaf4d6e21eac60d6b87b6d_JaffaCakes118.dll,#1
  2⤵
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads