77adbe32ffdd91d51c27c91ed5c309803c1e6b0191d69ef7126741690dea43ef | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5ef6d0c29bb81d37d01e091f841167b0_JaffaCakes118.dll
Size

32KB
MD5

5ef6d0c29bb81d37d01e091f841167b0
SHA1

288a11adc376b5622297b232b35fdbd0c929c385
SHA256

77adbe32ffdd91d51c27c91ed5c309803c1e6b0191d69ef7126741690dea43ef
SHA512

8469b99704507eeec2f12ab5b637c2bab6ba18a228749a992a888ec1d6f643de205d53e1c9d003d1412e8b31c2beb4c7dd3af88607f4f3de2af3c2fece8b739f
SSDEEP

768:X+9qa/tQKi4h90xdWxXubsTWm0ZgXBmH4T:XCLQLmbWAo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2792	2732	rundll32.exe	30
PID 2732 wrote to memory of 2792	2732	rundll32.exe	30
PID 2732 wrote to memory of 2792	2732	rundll32.exe	30
PID 2732 wrote to memory of 2792	2732	rundll32.exe	30
PID 2732 wrote to memory of 2792	2732	rundll32.exe	30
PID 2732 wrote to memory of 2792	2732	rundll32.exe	30
PID 2732 wrote to memory of 2792	2732	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ef6d0c29bb81d37d01e091f841167b0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ef6d0c29bb81d37d01e091f841167b0_JaffaCakes118.dll,#1
  2⤵
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads