03a8596758a038b48ee9787fe5fb6935f229406835b8f5c1ced9368cc980ffa4 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:51

Sharing

Report Analysis Logs

General

Target

645fec60eb0f9f3ce622cd81fa8572da_JaffaCakes118.dll
Size

3KB
MD5

645fec60eb0f9f3ce622cd81fa8572da
SHA1

4733bae77604ac0401647a5592174d36c8e45897
SHA256

03a8596758a038b48ee9787fe5fb6935f229406835b8f5c1ced9368cc980ffa4
SHA512

0e2ae4a8ea77635587d2bd96f026ac060b0ec085e9f15c305045702c20605bf9d4eb54c63883b255eac42d65bcd008000c95deb7f70476710c27224e502bcc81

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 776	2072	rundll32.exe	30
PID 2072 wrote to memory of 776	2072	rundll32.exe	30
PID 2072 wrote to memory of 776	2072	rundll32.exe	30
PID 2072 wrote to memory of 776	2072	rundll32.exe	30
PID 2072 wrote to memory of 776	2072	rundll32.exe	30
PID 2072 wrote to memory of 776	2072	rundll32.exe	30
PID 2072 wrote to memory of 776	2072	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\645fec60eb0f9f3ce622cd81fa8572da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\645fec60eb0f9f3ce622cd81fa8572da_JaffaCakes118.dll,#1
  2⤵
  PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/776-3-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/776-2-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/776-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download