c743f558a0ed6773926dd526537207691b33d14882705cac2aa9b61ad22b632a

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 03:01

Target

f02563a1ad488a3e2ed740d1406f5e19_JaffaCakes118.dll
Size

331KB
MD5

f02563a1ad488a3e2ed740d1406f5e19
SHA1

c192c849da7b2a45598c9fc68c5ce82aa9bbb2db
SHA256

c743f558a0ed6773926dd526537207691b33d14882705cac2aa9b61ad22b632a
SHA512

05edfb2f30a3c590be0d120ecf4509feb75c2198d4622ddbb517454586639e4dc6235504246e65eb9f6acf8725ae5f31104f502a40f51dd241ce8024f02a2df2
SSDEEP

3072:ApZg5bgZDNUQI2aMvCMjau9ypOg98KbvEKh1DvW/SpHDfsIHJI:CMgFNUQIm6MWu9ypN1vh1bbpHD

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3216-0-0x0000000000400000-0x0000000000486000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4812	3216	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 3216	456	rundll32.exe	83
PID 456 wrote to memory of 3216	456	rundll32.exe	83
PID 456 wrote to memory of 3216	456	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f02563a1ad488a3e2ed740d1406f5e19_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f02563a1ad488a3e2ed740d1406f5e19_JaffaCakes118.dll,#1
  2⤵
  PID:3216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 668
    3⤵
    - Program crash
    PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3216 -ip 3216
1⤵
PID:2040

memory/3216-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download