9ea8bcd10e76a7b327bff44f4c68f14505997e5ab4ff3a0afbfbefd1e7b20fa9 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

400bc48766dd6c8e5cedb126144d429f_JaffaCakes118.dll
Size

18KB
MD5

400bc48766dd6c8e5cedb126144d429f
SHA1

9f91c55c11f88e1b8468e8a1b20eb62800c65699
SHA256

9ea8bcd10e76a7b327bff44f4c68f14505997e5ab4ff3a0afbfbefd1e7b20fa9
SHA512

eb73c5e65ac25f2ec65c4df65b7fc8fd2740c7d04369e6eaae1838ae32ce304519f9d9ed7e2c914842dc0612e09d898fcefa9dd8b849bf20a3b57f91a5a04835
SSDEEP

384:f2gFw7nQjT1T7ckf0fSBJEPib8/AZX1ww:y7sT1TVQSAPig/1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 580	2404	rundll32.exe	30
PID 2404 wrote to memory of 580	2404	rundll32.exe	30
PID 2404 wrote to memory of 580	2404	rundll32.exe	30
PID 2404 wrote to memory of 580	2404	rundll32.exe	30
PID 2404 wrote to memory of 580	2404	rundll32.exe	30
PID 2404 wrote to memory of 580	2404	rundll32.exe	30
PID 2404 wrote to memory of 580	2404	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\400bc48766dd6c8e5cedb126144d429f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\400bc48766dd6c8e5cedb126144d429f_JaffaCakes118.dll,#1
  2⤵
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads