fd0498c5eef0485125c5e4c859a73c121518fd880d26e6e7451ea9732c0f89db | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 05:45

Sharing

Report Analysis Logs

General

Target

2f2dcef4f0b66b177bfe9daa77d10a94_JaffaCakes118.dll
Size

7KB
MD5

2f2dcef4f0b66b177bfe9daa77d10a94
SHA1

01acb0e411a81eef33ff84b940878c6aa0d25a8b
SHA256

fd0498c5eef0485125c5e4c859a73c121518fd880d26e6e7451ea9732c0f89db
SHA512

18d390b80b065e2d521d7d2aad3fbed9e6e5cb85eae67fd9671693d9a2dc411d6e6250d89c72a7be1bab9058928cbe88db3def1c4f400df887673d1cf76630cc
SSDEEP

96:uPIu0iI4r8a1MlDHQtMJ9vQLYYIMaJWaVXbn:ugsr8LtJVQkJWaV

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3188	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3188	3480	rundll32.exe	82
PID 3480 wrote to memory of 3188	3480	rundll32.exe	82
PID 3480 wrote to memory of 3188	3480	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2dcef4f0b66b177bfe9daa77d10a94_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2dcef4f0b66b177bfe9daa77d10a94_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3188-0-0x0000000000620000-0x0000000000627000-memory.dmp

Filesize
28KB

Download