5da97c9d73b561359be996f137e1de84438fb8406e0c9b41ef5a4173cff9bd79 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 05:48

Sharing

Report Analysis Logs

General

Target

487aaf318c9eed5ce58b703ed3afa7b8_JaffaCakes118.dll
Size

114KB
MD5

487aaf318c9eed5ce58b703ed3afa7b8
SHA1

748439632470d3841c7da64b0ef390fc5a7da23f
SHA256

5da97c9d73b561359be996f137e1de84438fb8406e0c9b41ef5a4173cff9bd79
SHA512

c9fe06e9e344d68e162e63792f71cfb29d009902f1c3e70fa3e81c5de844d64ec5192262875cb7fd117a87c8345ecfd867a9e31e524b280fd490e6e794a234b3
SSDEEP

3072:GrGsRPEVx36URhvXp7ewH+N5/O8FV72eg:lGURdI9m8FVS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2372	2464	rundll32.exe	30
PID 2464 wrote to memory of 2372	2464	rundll32.exe	30
PID 2464 wrote to memory of 2372	2464	rundll32.exe	30
PID 2464 wrote to memory of 2372	2464	rundll32.exe	30
PID 2464 wrote to memory of 2372	2464	rundll32.exe	30
PID 2464 wrote to memory of 2372	2464	rundll32.exe	30
PID 2464 wrote to memory of 2372	2464	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\487aaf318c9eed5ce58b703ed3afa7b8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\487aaf318c9eed5ce58b703ed3afa7b8_JaffaCakes118.dll,#1
  2⤵
  PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads