00ef51ccad4433f036e6d719aa37478b16dab60aad9c2836767130d4d3591314 | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 08:45

Sharing

Report Analysis Logs

General

Target

4d96cf17ae21bb93ca87cb2c3f4071f0_JaffaCakes118.dll
Size

4KB
MD5

4d96cf17ae21bb93ca87cb2c3f4071f0
SHA1

f5447043de09502bc1ec1ebb5c217740ad2955a6
SHA256

00ef51ccad4433f036e6d719aa37478b16dab60aad9c2836767130d4d3591314
SHA512

f5f19e9e15b48ab4efd262cb2dd1766b5803a0d2ab941625a1c48827e4126efe4244d11114a22c4952cf4d72003d9f8ed9e954ec47da3bbd7c311d86f29e4765

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2892	2164	rundll32.exe	30
PID 2164 wrote to memory of 2892	2164	rundll32.exe	30
PID 2164 wrote to memory of 2892	2164	rundll32.exe	30
PID 2164 wrote to memory of 2892	2164	rundll32.exe	30
PID 2164 wrote to memory of 2892	2164	rundll32.exe	30
PID 2164 wrote to memory of 2892	2164	rundll32.exe	30
PID 2164 wrote to memory of 2892	2164	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d96cf17ae21bb93ca87cb2c3f4071f0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d96cf17ae21bb93ca87cb2c3f4071f0_JaffaCakes118.dll,#1
  2⤵
  PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download