54ed67e2c383fd4aebc2b1102467acf4a69d0ea2a795c19bd6810ee4f5e559d2 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47ee1199fd92352b7baaafd02547a7f9_JaffaCakes118.dll
Size

624KB
MD5

47ee1199fd92352b7baaafd02547a7f9
SHA1

6a79082eeccd9f74f569ce852180694406659289
SHA256

54ed67e2c383fd4aebc2b1102467acf4a69d0ea2a795c19bd6810ee4f5e559d2
SHA512

b24b9a1876dedf79e6ad02f9bc4f2cbd6ff0954826884a57e12370f40c64a4df32cc27be39a3b2e37e1de45a97d45a4260b2deac2492349c623c32e1b0b8ac13
SSDEEP

6144:lpUfTIjivFqN6RkZK+sK6vMdfn/YHkzhscnAuhi:HULtX1j

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2348	2328	rundll32.exe	31
PID 2328 wrote to memory of 2348	2328	rundll32.exe	31
PID 2328 wrote to memory of 2348	2328	rundll32.exe	31
PID 2328 wrote to memory of 2348	2328	rundll32.exe	31
PID 2328 wrote to memory of 2348	2328	rundll32.exe	31
PID 2328 wrote to memory of 2348	2328	rundll32.exe	31
PID 2328 wrote to memory of 2348	2328	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47ee1199fd92352b7baaafd02547a7f9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47ee1199fd92352b7baaafd02547a7f9_JaffaCakes118.dll,#1
  2⤵
  PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads