5f9db29ddf2a35c923d3067c8c1390bfceb77fc18533648a0becee603d0d1d49 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 00:32

Sharing

Report Analysis Logs

General

Target

4773db0f5af125f94ef41cd793cb6099_JaffaCakes118.dll
Size

48KB
MD5

4773db0f5af125f94ef41cd793cb6099
SHA1

e75b88f19415321d3b34455306eb0b7609b60b3b
SHA256

5f9db29ddf2a35c923d3067c8c1390bfceb77fc18533648a0becee603d0d1d49
SHA512

50aa1fdabaa26598f9d9f1e30a7b68e16457ac61132f9a72c54d8f0b10deef15f68e86985c87198d7b3a3ff6319042a1a3cc5d7c6390774fc7c80269b83130ed
SSDEEP

768:ebpNEzQ+nJcsiQ1TFxX7efLTN4soiGgqfm:8OJc2TYLEilqf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2092	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2092	2348	rundll32.exe	31
PID 2348 wrote to memory of 2092	2348	rundll32.exe	31
PID 2348 wrote to memory of 2092	2348	rundll32.exe	31
PID 2348 wrote to memory of 2092	2348	rundll32.exe	31
PID 2348 wrote to memory of 2092	2348	rundll32.exe	31
PID 2348 wrote to memory of 2092	2348	rundll32.exe	31
PID 2348 wrote to memory of 2092	2348	rundll32.exe	31
PID 2092 wrote to memory of 1196	2092	rundll32.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4773db0f5af125f94ef41cd793cb6099_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4773db0f5af125f94ef41cd793cb6099_JaffaCakes118.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download