9d1daa81e67478b19aaf7dbd99193c224d5956e52bfae25703c6616dc7050fc4 | Triage

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 00:39

Sharing

Report Analysis Logs

General

Target

370caa214e57dd3651c9a8e624d91556_JaffaCakes118.dll
Size

3KB
MD5

370caa214e57dd3651c9a8e624d91556
SHA1

78daddbdd58fb6b729f30abda06ebf33c2e6bda0
SHA256

9d1daa81e67478b19aaf7dbd99193c224d5956e52bfae25703c6616dc7050fc4
SHA512

bea8a4ec6723b711274305d62a6db0811e1c284f14e646f8f16e85294bea6e68b5bbe506df984e81096abbde8c2c726d44e4d585f12a9dff65adbdf7d803b971

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 2756	4408	rundll32.exe	83
PID 4408 wrote to memory of 2756	4408	rundll32.exe	83
PID 4408 wrote to memory of 2756	4408	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\370caa214e57dd3651c9a8e624d91556_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\370caa214e57dd3651c9a8e624d91556_JaffaCakes118.dll,#1
  2⤵
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads