c4de2ff21a5ace93f5538e3dd772ac683c14af01f98b356b5d7bab5efebe96af | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 12:15

Sharing

Report Analysis Logs

General

Target

34ad530c6b08ab592ae91494e6efc6b4_JaffaCakes118.dll
Size

4KB
MD5

34ad530c6b08ab592ae91494e6efc6b4
SHA1

cfa094ebc0abf99b57887165e9215e25f3473703
SHA256

c4de2ff21a5ace93f5538e3dd772ac683c14af01f98b356b5d7bab5efebe96af
SHA512

3be2c049b59c50b3816c7f13a42edebe327ac59a45919d1aee0cc2cb82431e9af1d401f11ee2ea13c659a97efa551959eee821b0941214737fbe5e7f791f3042

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2472	2984	rundll32.exe	31
PID 2984 wrote to memory of 2472	2984	rundll32.exe	31
PID 2984 wrote to memory of 2472	2984	rundll32.exe	31
PID 2984 wrote to memory of 2472	2984	rundll32.exe	31
PID 2984 wrote to memory of 2472	2984	rundll32.exe	31
PID 2984 wrote to memory of 2472	2984	rundll32.exe	31
PID 2984 wrote to memory of 2472	2984	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34ad530c6b08ab592ae91494e6efc6b4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34ad530c6b08ab592ae91494e6efc6b4_JaffaCakes118.dll,#1
  2⤵
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads