4631eaa9c5d930a09ef309727279a0a57ea62c1bd0141a19751a26d2d7d6c6b4 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 00:16

Sharing

Report Analysis Logs

General

Target

59b10aa872af76ba17f55392cad05767_JaffaCakes118.dll
Size

133KB
MD5

59b10aa872af76ba17f55392cad05767
SHA1

3ede931adc6e4ccf00c87cd7f5c1f426bc6e6c98
SHA256

4631eaa9c5d930a09ef309727279a0a57ea62c1bd0141a19751a26d2d7d6c6b4
SHA512

fd9d5255b474e0452e6e88edd761aac084b2a7e451e71cb6607238c304c124942132ddb7578d288d8199b5b8e7f9839411718581538f2a993d313c3dea3c1c1e
SSDEEP

3072:fs2+CxQ1MecvAXrRt8x6o7Piv2Piv2Piv2Pivv:eMKJz2ppp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2988	2984	rundll32.exe	30
PID 2984 wrote to memory of 2988	2984	rundll32.exe	30
PID 2984 wrote to memory of 2988	2984	rundll32.exe	30
PID 2984 wrote to memory of 2988	2984	rundll32.exe	30
PID 2984 wrote to memory of 2988	2984	rundll32.exe	30
PID 2984 wrote to memory of 2988	2984	rundll32.exe	30
PID 2984 wrote to memory of 2988	2984	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b10aa872af76ba17f55392cad05767_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b10aa872af76ba17f55392cad05767_JaffaCakes118.dll,#1
  2⤵
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x00000000001D0000-0x00000000001F6000-memory.dmp

Filesize
152KB

Download