b0f3ba0952944573f0b5ec01051c8fa9270fd3342b91118397b1a877179345fd | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 00:04

Sharing

Report Analysis Logs

General

Target

36f0e5e43e217ccb428da48ef1d68f26_JaffaCakes118.dll
Size

30KB
MD5

36f0e5e43e217ccb428da48ef1d68f26
SHA1

72ee36244a61fb1818ad82a464ef37e6095b1159
SHA256

b0f3ba0952944573f0b5ec01051c8fa9270fd3342b91118397b1a877179345fd
SHA512

19dc203870152f11b15273653c6e029cd3b401c9a368188b16e4125afa0766b5eb1849799f2c6e2a2987f63cb5989fedc1cb4a8bc78581ab4b0f026fd274abc8
SSDEEP

768:hfHlcFr5klQLSmwTm43vYO3rCkItZDW9I:hQdSmH43vYO7psZC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30
PID 2116 wrote to memory of 2512	2116	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36f0e5e43e217ccb428da48ef1d68f26_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36f0e5e43e217ccb428da48ef1d68f26_JaffaCakes118.dll,#1
  2⤵
  PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2512-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download