b987edcd3a2ce349ab1e0fb39bf4e7ca47c6f5183259fda6ba99fa38e7c36cd1 | Triage

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 04:03

Sharing

Report Analysis Logs

General

Target

660fda5b7893ff415d4e6ed06848aafb_JaffaCakes118.dll
Size

3KB
MD5

660fda5b7893ff415d4e6ed06848aafb
SHA1

75cea4a3643c63cdeb3ed2a5a0c42cd60cd7c4ba
SHA256

b987edcd3a2ce349ab1e0fb39bf4e7ca47c6f5183259fda6ba99fa38e7c36cd1
SHA512

4116445759fb1c659b5cdbdef0202e1221d17df898170e7a2db6924fbead31a5761887afab723eb803d0ed6dd0eadf7ef5190d6cb56b5502291b0d178df27c26

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 8	3932	rundll32.exe	86
PID 3932 wrote to memory of 8	3932	rundll32.exe	86
PID 3932 wrote to memory of 8	3932	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\660fda5b7893ff415d4e6ed06848aafb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\660fda5b7893ff415d4e6ed06848aafb_JaffaCakes118.dll,#1
  2⤵
  PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads