fd0498c5eef0485125c5e4c859a73c121518fd880d26e6e7451ea9732c0f89db | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 05:45

Sharing

Report Analysis Logs

General

Target

2f2dcef4f0b66b177bfe9daa77d10a94_JaffaCakes118.dll
Size

7KB
MD5

2f2dcef4f0b66b177bfe9daa77d10a94
SHA1

01acb0e411a81eef33ff84b940878c6aa0d25a8b
SHA256

fd0498c5eef0485125c5e4c859a73c121518fd880d26e6e7451ea9732c0f89db
SHA512

18d390b80b065e2d521d7d2aad3fbed9e6e5cb85eae67fd9671693d9a2dc411d6e6250d89c72a7be1bab9058928cbe88db3def1c4f400df887673d1cf76630cc
SSDEEP

96:uPIu0iI4r8a1MlDHQtMJ9vQLYYIMaJWaVXbn:ugsr8LtJVQkJWaV

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2292	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2292	2288	rundll32.exe	30
PID 2288 wrote to memory of 2292	2288	rundll32.exe	30
PID 2288 wrote to memory of 2292	2288	rundll32.exe	30
PID 2288 wrote to memory of 2292	2288	rundll32.exe	30
PID 2288 wrote to memory of 2292	2288	rundll32.exe	30
PID 2288 wrote to memory of 2292	2288	rundll32.exe	30
PID 2288 wrote to memory of 2292	2288	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2dcef4f0b66b177bfe9daa77d10a94_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2dcef4f0b66b177bfe9daa77d10a94_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x00000000776EF000-0x00000000776F0000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download