bdc699c561f825b196cc910f71510c22569ddd7234f6f660cebf1dff364f594b | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 10:51

Sharing

Report Analysis Logs

General

Target

4dfce420644baf195b73803e444a0561_JaffaCakes118.dll
Size

240KB
MD5

4dfce420644baf195b73803e444a0561
SHA1

0a390d066c1833136e01cf16a16c273a457db1ac
SHA256

bdc699c561f825b196cc910f71510c22569ddd7234f6f660cebf1dff364f594b
SHA512

5b129f18e7d0ddf2ccf043a5af1cfa21a9945f3e6c45f79381c9ccd042d6ed34603d50648dea156e2313222b31261e16b256f33d4633646d16765a5a4beddf30
SSDEEP

6144:opqbEM8EDmp7FnQh+Z95WlSk2j9nMIHd:0qbHnDmGY9MWDd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2516	2084	rundll32.exe	30
PID 2084 wrote to memory of 2516	2084	rundll32.exe	30
PID 2084 wrote to memory of 2516	2084	rundll32.exe	30
PID 2084 wrote to memory of 2516	2084	rundll32.exe	30
PID 2084 wrote to memory of 2516	2084	rundll32.exe	30
PID 2084 wrote to memory of 2516	2084	rundll32.exe	30
PID 2084 wrote to memory of 2516	2084	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dfce420644baf195b73803e444a0561_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dfce420644baf195b73803e444a0561_JaffaCakes118.dll,#1
  2⤵
  PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads