4d877d10aa29654afe58caf9b6455623f3e448f3f7c8edc2a3214ad9a24bf5ce | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 03:13

Sharing

Report Analysis Logs

General

Target

440e443b53a2bb2bb6d08083a1ffefa7_JaffaCakes118.dll
Size

3KB
MD5

440e443b53a2bb2bb6d08083a1ffefa7
SHA1

c6903cc41de4963bbe8f725de83fcd2081609203
SHA256

4d877d10aa29654afe58caf9b6455623f3e448f3f7c8edc2a3214ad9a24bf5ce
SHA512

e896d565fb956a293ba6f5d4b4ccbf4056405a59fe9bacf40353d10bd85440e61b3964bfbd785352932459fa978c7cc58828e37add3e4db274dcf7b75d8e9615

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2572	1660	rundll32.exe	30
PID 1660 wrote to memory of 2572	1660	rundll32.exe	30
PID 1660 wrote to memory of 2572	1660	rundll32.exe	30
PID 1660 wrote to memory of 2572	1660	rundll32.exe	30
PID 1660 wrote to memory of 2572	1660	rundll32.exe	30
PID 1660 wrote to memory of 2572	1660	rundll32.exe	30
PID 1660 wrote to memory of 2572	1660	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\440e443b53a2bb2bb6d08083a1ffefa7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\440e443b53a2bb2bb6d08083a1ffefa7_JaffaCakes118.dll,#1
  2⤵
  PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads