3e980812ecae7a37fe0c3ea98b8c3e196e77331ad64447a8adfcef00a76456cf | Triage

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 04:51

Sharing

Report Analysis Logs

General

Target

4044fcce082016c231805df798cbd1f7_JaffaCakes118.dll
Size

49KB
MD5

4044fcce082016c231805df798cbd1f7
SHA1

0300686e0194baa5d01737fad8ee1df9cc34a4ba
SHA256

3e980812ecae7a37fe0c3ea98b8c3e196e77331ad64447a8adfcef00a76456cf
SHA512

b30f01851a40df6f811f587a97d05563595960beef25a81d8579da22b3c0276f219858156017eeb1eaa4bb7ee7313cacce3abb4b033ebb857ae71f1ed6758adf
SSDEEP

1536:X2liuhkOJRTnnqAWJOtOnYEkcJN1QBi1:X20uhkOJ8jdnY6Qe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 2100	408	rundll32.exe	83
PID 408 wrote to memory of 2100	408	rundll32.exe	83
PID 408 wrote to memory of 2100	408	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4044fcce082016c231805df798cbd1f7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4044fcce082016c231805df798cbd1f7_JaffaCakes118.dll,#1
  2⤵
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x00000000006C0000-0x00000000006E5000-memory.dmp

Filesize
148KB

Download