603980369b0770c17148159f66b6af37c8c47d10711c72011b9b420edd537669 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 23:32

Sharing

Report Analysis Logs

General

Target

2734722ce64d188c8e2a57d831ce1b12_JaffaCakes118.dll
Size

8KB
MD5

2734722ce64d188c8e2a57d831ce1b12
SHA1

c6a32c220899f1f42fcaabe725058e8f20663604
SHA256

603980369b0770c17148159f66b6af37c8c47d10711c72011b9b420edd537669
SHA512

9d614adc63d4c6cd6152554d5c8e867b74f27b19f5f3b7375ee21d96709f2af5c81a2c38ff563b535d8a18d1fddb4b1cd32157df9efe82d5a27fade98505c7a7
SSDEEP

192:wwX0IJcDsS2Jis4Agi8rQXE0CVDI5diFK:wU3ZspDG

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1080	1964	rundll32.exe	31
PID 1964 wrote to memory of 1080	1964	rundll32.exe	31
PID 1964 wrote to memory of 1080	1964	rundll32.exe	31
PID 1964 wrote to memory of 1080	1964	rundll32.exe	31
PID 1964 wrote to memory of 1080	1964	rundll32.exe	31
PID 1964 wrote to memory of 1080	1964	rundll32.exe	31
PID 1964 wrote to memory of 1080	1964	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2734722ce64d188c8e2a57d831ce1b12_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2734722ce64d188c8e2a57d831ce1b12_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads