3fc147d27a08b55c0aa1d345be5fbab927438f798f76a555c6afe74732702673 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 11:00

Sharing

Report Analysis Logs

General

Target

497d68a9e88a8e86ce87ccef554b2a00_JaffaCakes118.dll
Size

30KB
MD5

497d68a9e88a8e86ce87ccef554b2a00
SHA1

7ba968cc1d87d23593072415a76f559193b62a07
SHA256

3fc147d27a08b55c0aa1d345be5fbab927438f798f76a555c6afe74732702673
SHA512

1988ab7815312801f92c2b3a186269f6c40459a5ec03578ee3b5de8d758cdc003caf0e9552ada5ac5bb9ed47503ebb4cf2612003b1e7496f937390ad5fcb42a4
SSDEEP

768:QDFBxXRC9+B4VBfUvJgHPkWvWOJalay9h:QDnxU04VaUJaUM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 3032	2864	rundll32.exe	30
PID 2864 wrote to memory of 3032	2864	rundll32.exe	30
PID 2864 wrote to memory of 3032	2864	rundll32.exe	30
PID 2864 wrote to memory of 3032	2864	rundll32.exe	30
PID 2864 wrote to memory of 3032	2864	rundll32.exe	30
PID 2864 wrote to memory of 3032	2864	rundll32.exe	30
PID 2864 wrote to memory of 3032	2864	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\497d68a9e88a8e86ce87ccef554b2a00_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\497d68a9e88a8e86ce87ccef554b2a00_JaffaCakes118.dll,#1
  2⤵
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download