2ddc089d6d91437a27545aaf5811f13338017afaafe3dc537e2bfd063cf6d7a7 | Triage

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 16:18

Sharing

Report Analysis Logs

General

Target

4694c9b4c2f79b43fc1c7cdf2c1845cc_JaffaCakes118.dll
Size

3KB
MD5

4694c9b4c2f79b43fc1c7cdf2c1845cc
SHA1

9c02167f5c630b030b19f50f39ad06c7bde4a76e
SHA256

2ddc089d6d91437a27545aaf5811f13338017afaafe3dc537e2bfd063cf6d7a7
SHA512

7f840ad9c660a970010c3921cf5f19d57a636f6e4e380072b21ee2617b5ce1618db13ace56ffe3bfa0887b87c63b16d7b1a86a043a78d9db4d93e54121fdb0c8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2752	4468	rundll32.exe	83
PID 4468 wrote to memory of 2752	4468	rundll32.exe	83
PID 4468 wrote to memory of 2752	4468	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4694c9b4c2f79b43fc1c7cdf2c1845cc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4694c9b4c2f79b43fc1c7cdf2c1845cc_JaffaCakes118.dll,#1
  2⤵
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads