feabab980bb4b8ca5661a35a31a2569aad25735c8933aeef8f4110888a928590

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 13:59

Target

e79e3c59f516ff08b3504c13d6a37ef0_JaffaCakes118.dll
Size

1.1MB
MD5

e79e3c59f516ff08b3504c13d6a37ef0
SHA1

ec2bc306a3bce985572988d26f643618a976aebf
SHA256

feabab980bb4b8ca5661a35a31a2569aad25735c8933aeef8f4110888a928590
SHA512

c73da64754473739ba354bee883461a51c0aa47059b624ad63f2ab18d4f9b3eb4c2a8c90c0ef964586363281f3c3ea4dfc68374ea96f309a6e4653a04893447a
SSDEEP

24576:nSFOpgDugIJA1LveIgop7IfAm/fAfiXKv/VN:nSq2IJAxvDg4uXSV/T

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1008-0-0x0000000010000000-0x000000001027B000-memory.dmp	vmprotect
behavioral2/memory/1008-1-0x0000000010000000-0x000000001027B000-memory.dmp	vmprotect

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1008	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 1008	3596	rundll32.exe	86
PID 3596 wrote to memory of 1008	3596	rundll32.exe	86
PID 3596 wrote to memory of 1008	3596	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e79e3c59f516ff08b3504c13d6a37ef0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e79e3c59f516ff08b3504c13d6a37ef0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1008

memory/1008-0-0x0000000010000000-0x000000001027B000-memory.dmp

Filesize
2.5MB

Download
memory/1008-1-0x0000000010000000-0x000000001027B000-memory.dmp

Filesize
2.5MB

Download