2a020d521b2de2f9f4cd14457b635e6f2613654a14533e4dba94edc12c36ef5c | Triage

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 09:00

Sharing

Report Analysis Logs

General

Target

387c545d497e55d0fd536f1edd81ed52_JaffaCakes118.dll
Size

2KB
MD5

387c545d497e55d0fd536f1edd81ed52
SHA1

756d6c70a6a329b0d81f1c52eec076b2fccb4619
SHA256

2a020d521b2de2f9f4cd14457b635e6f2613654a14533e4dba94edc12c36ef5c
SHA512

4b046cc53c3ae14826a5915c7cfb1f5e3d3897c95b60cc3d5f01e6f41348c947d98e2cb5ce602f17c1fd9408ffb6d3d3833f3eaf22019de102cb8512fdaec61e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1140	2244	rundll32.exe	30
PID 2244 wrote to memory of 1140	2244	rundll32.exe	30
PID 2244 wrote to memory of 1140	2244	rundll32.exe	30
PID 2244 wrote to memory of 1140	2244	rundll32.exe	30
PID 2244 wrote to memory of 1140	2244	rundll32.exe	30
PID 2244 wrote to memory of 1140	2244	rundll32.exe	30
PID 2244 wrote to memory of 1140	2244	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\387c545d497e55d0fd536f1edd81ed52_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\387c545d497e55d0fd536f1edd81ed52_JaffaCakes118.dll,#1
  2⤵
  PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-1-0x000000007C340000-0x000000007C397000-memory.dmp

Filesize
348KB

Download
memory/1140-0-0x000000007C340000-0x000000007C397000-memory.dmp

Filesize
348KB

Download