4a8ce6c7d703175386446673ebee0139e41976e5d99c345d15d1e7c48bfd49c8 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 22:30

Sharing

Report Analysis Logs

General

Target

296e88064266c46a3c159eb473614265_JaffaCakes118.dll
Size

132KB
MD5

296e88064266c46a3c159eb473614265
SHA1

de61ef601530a66689b024c450152426cff0e9ef
SHA256

4a8ce6c7d703175386446673ebee0139e41976e5d99c345d15d1e7c48bfd49c8
SHA512

33f32652498033abc8ff18e732bd3aa07b7a401d5fd9f9962c7499964215c492b5dd7f4d59373197b4040c660e46a4f6c09840ab3fee0ae6f749fa257efd1023
SSDEEP

3072:/IaWBXo9X1DHlV/FdL9FHpj1+GGKnSAyEDJ:7bftF3Jj0CN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\296e88064266c46a3c159eb473614265_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\296e88064266c46a3c159eb473614265_JaffaCakes118.dll,#1
  2⤵
  PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads