55667b49e3bdb182740d613fdeb44d0187866598e0266e20d465d20644120ee7 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 10:01

Sharing

Report Analysis Logs

General

Target

494f0feb3e724b3fe78aa83587a5c236_JaffaCakes118.dll
Size

3KB
MD5

494f0feb3e724b3fe78aa83587a5c236
SHA1

7479760e211d5ebf7348661a6dd388b42b9ab7db
SHA256

55667b49e3bdb182740d613fdeb44d0187866598e0266e20d465d20644120ee7
SHA512

dc1d198b24f5ef38205e69aab5ca615243171e07b29e4dd1a05a75ae74aabf1e97186e07e1b0c933f76ab380e15c4c187f3f5b0c203b610751c157995ded1055

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1900	1820	rundll32.exe	30
PID 1820 wrote to memory of 1900	1820	rundll32.exe	30
PID 1820 wrote to memory of 1900	1820	rundll32.exe	30
PID 1820 wrote to memory of 1900	1820	rundll32.exe	30
PID 1820 wrote to memory of 1900	1820	rundll32.exe	30
PID 1820 wrote to memory of 1900	1820	rundll32.exe	30
PID 1820 wrote to memory of 1900	1820	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\494f0feb3e724b3fe78aa83587a5c236_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\494f0feb3e724b3fe78aa83587a5c236_JaffaCakes118.dll,#1
  2⤵
  PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads