d424728bf7b679243db8c1186b490ee8bb6e75dd059cfed0d80f2631777e3eef | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

606e45f9e8c06858d2de734b01e5399f_JaffaCakes118.dll
Size

2KB
MD5

606e45f9e8c06858d2de734b01e5399f
SHA1

56ba7cc3425acc2302831dab1be848b6bb0d6bdc
SHA256

d424728bf7b679243db8c1186b490ee8bb6e75dd059cfed0d80f2631777e3eef
SHA512

9c5d520f111636f79b3a15e632c65dbd08d5187f382926d420e0ef5c67917e12a5355f31aa0437dd1905385f83377e4e6c539f69889482b760bfbb41b78d30e5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1652	2520	rundll32.exe	30
PID 2520 wrote to memory of 1652	2520	rundll32.exe	30
PID 2520 wrote to memory of 1652	2520	rundll32.exe	30
PID 2520 wrote to memory of 1652	2520	rundll32.exe	30
PID 2520 wrote to memory of 1652	2520	rundll32.exe	30
PID 2520 wrote to memory of 1652	2520	rundll32.exe	30
PID 2520 wrote to memory of 1652	2520	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\606e45f9e8c06858d2de734b01e5399f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\606e45f9e8c06858d2de734b01e5399f_JaffaCakes118.dll,#1
  2⤵
  PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-1-0x0000000010000000-0x0000000010031000-memory.dmp

Filesize
196KB

Download
memory/1652-0-0x0000000010000000-0x0000000010031000-memory.dmp

Filesize
196KB

Download