c743f558a0ed6773926dd526537207691b33d14882705cac2aa9b61ad22b632a

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 03:01

Target

f02563a1ad488a3e2ed740d1406f5e19_JaffaCakes118.dll
Size

331KB
MD5

f02563a1ad488a3e2ed740d1406f5e19
SHA1

c192c849da7b2a45598c9fc68c5ce82aa9bbb2db
SHA256

c743f558a0ed6773926dd526537207691b33d14882705cac2aa9b61ad22b632a
SHA512

05edfb2f30a3c590be0d120ecf4509feb75c2198d4622ddbb517454586639e4dc6235504246e65eb9f6acf8725ae5f31104f502a40f51dd241ce8024f02a2df2
SSDEEP

3072:ApZg5bgZDNUQI2aMvCMjau9ypOg98KbvEKh1DvW/SpHDfsIHJI:CMgFNUQIm6MWu9ypN1vh1bbpHD

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2024-1-0x0000000000250000-0x00000000002D6000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2024	1740	rundll32.exe	28
PID 1740 wrote to memory of 2024	1740	rundll32.exe	28
PID 1740 wrote to memory of 2024	1740	rundll32.exe	28
PID 1740 wrote to memory of 2024	1740	rundll32.exe	28
PID 1740 wrote to memory of 2024	1740	rundll32.exe	28
PID 1740 wrote to memory of 2024	1740	rundll32.exe	28
PID 1740 wrote to memory of 2024	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f02563a1ad488a3e2ed740d1406f5e19_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f02563a1ad488a3e2ed740d1406f5e19_JaffaCakes118.dll,#1
  2⤵
  PID:2024

memory/2024-0-0x0000000000250000-0x00000000002D6000-memory.dmp

Filesize
536KB

Download
memory/2024-1-0x0000000000250000-0x00000000002D6000-memory.dmp

Filesize
536KB

Download
memory/2024-2-0x0000000000250000-0x00000000002D6000-memory.dmp

Filesize
536KB

Download