b9760b126eda531929fa3a0f85250d4444a5f94e3672072c56c84f159304ebfc | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2f6e00026da9853ae5086bb7920afd6d_JaffaCakes118.dll
Size

58KB
MD5

2f6e00026da9853ae5086bb7920afd6d
SHA1

0c2168ba99f99740515f8b324c12687f2fee42fa
SHA256

b9760b126eda531929fa3a0f85250d4444a5f94e3672072c56c84f159304ebfc
SHA512

e9fb3543174f20a067e3deaed4c305e9ec81ec81b0fefceb4d43b131bff645753a3a535765b259c680a2161bbb21f081f2fc518c908b880a1af20029a320a0c5
SSDEEP

1536:5oAfbH7A3lu3oYjEpgRxF5v7u9ExdIvQ4:5oW7slutKuFV7um

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2652	2476	rundll32.exe	31
PID 2476 wrote to memory of 2652	2476	rundll32.exe	31
PID 2476 wrote to memory of 2652	2476	rundll32.exe	31
PID 2476 wrote to memory of 2652	2476	rundll32.exe	31
PID 2476 wrote to memory of 2652	2476	rundll32.exe	31
PID 2476 wrote to memory of 2652	2476	rundll32.exe	31
PID 2476 wrote to memory of 2652	2476	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f6e00026da9853ae5086bb7920afd6d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f6e00026da9853ae5086bb7920afd6d_JaffaCakes118.dll,#1
  2⤵
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download