c779cac4439d0e3e486f45da7c271182e8ab25cb0e09864250a7fbb2b0a84e5d | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 21:34

Sharing

Report Analysis Logs

General

Target

2de20842b7ed725257b7522a08345c1c_JaffaCakes118.dll
Size

2KB
MD5

2de20842b7ed725257b7522a08345c1c
SHA1

b471a7c6e0f876f0e7f539ed7a2bdd52c6e12ead
SHA256

c779cac4439d0e3e486f45da7c271182e8ab25cb0e09864250a7fbb2b0a84e5d
SHA512

acfeabd05440176edcaea3c2f198620adc3dd4b4cf6e8bef66899a817002ce4f988c569d568c289f04c03c704f29fa60ac10c57c8db0a4a789ea7b3a0e16d4a3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2de20842b7ed725257b7522a08345c1c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2de20842b7ed725257b7522a08345c1c_JaffaCakes118.dll,#1
  2⤵
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads