b987edcd3a2ce349ab1e0fb39bf4e7ca47c6f5183259fda6ba99fa38e7c36cd1 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 04:03

Sharing

Report Analysis Logs

General

Target

660fda5b7893ff415d4e6ed06848aafb_JaffaCakes118.dll
Size

3KB
MD5

660fda5b7893ff415d4e6ed06848aafb
SHA1

75cea4a3643c63cdeb3ed2a5a0c42cd60cd7c4ba
SHA256

b987edcd3a2ce349ab1e0fb39bf4e7ca47c6f5183259fda6ba99fa38e7c36cd1
SHA512

4116445759fb1c659b5cdbdef0202e1221d17df898170e7a2db6924fbead31a5761887afab723eb803d0ed6dd0eadf7ef5190d6cb56b5502291b0d178df27c26

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2632	2636	rundll32.exe	30
PID 2636 wrote to memory of 2632	2636	rundll32.exe	30
PID 2636 wrote to memory of 2632	2636	rundll32.exe	30
PID 2636 wrote to memory of 2632	2636	rundll32.exe	30
PID 2636 wrote to memory of 2632	2636	rundll32.exe	30
PID 2636 wrote to memory of 2632	2636	rundll32.exe	30
PID 2636 wrote to memory of 2632	2636	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\660fda5b7893ff415d4e6ed06848aafb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\660fda5b7893ff415d4e6ed06848aafb_JaffaCakes118.dll,#1
  2⤵
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads