3d96ff479d9da2929769671c2ebb4787ecbce7b008b636abcc7cd6a31bdda329

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 10:03

Target

f0cbef92032f577614231e09fc0c3b97_JaffaCakes118.dll
Size

740KB
MD5

f0cbef92032f577614231e09fc0c3b97
SHA1

61174ae52afadb9e9eed530975f52a3491bf5a10
SHA256

3d96ff479d9da2929769671c2ebb4787ecbce7b008b636abcc7cd6a31bdda329
SHA512

abe4504a01d9e9e406fded58bd5d7cdfdfca78e42f9ecab5f8beb951623e9dbfff40a640bd18687c4e468ac3422829268781a0524efe2f74ea79b1be0c9fe899
SSDEEP

12288:Af68zjnT+2a8+p0/IARbJkale360zCA9JK7LdBzSZd6Z/+rXm5AQKa8/VyFcajNp:Ajjny2a8S0/1EaleYUKn2ZY2TmAQN0Vi

Score

7^/10

vmprotect

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1392-0-0x0000000002020000-0x00000000021D4000-memory.dmp	vmprotect
behavioral1/memory/1392-1-0x0000000002020000-0x00000000021D4000-memory.dmp	vmprotect
behavioral1/memory/1392-2-0x0000000002020000-0x00000000021D4000-memory.dmp	vmprotect
behavioral1/memory/1392-3-0x0000000002020000-0x00000000021D4000-memory.dmp	vmprotect
behavioral1/memory/1392-4-0x0000000002020000-0x00000000021D4000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1392	1356	rundll32.exe	28
PID 1356 wrote to memory of 1392	1356	rundll32.exe	28
PID 1356 wrote to memory of 1392	1356	rundll32.exe	28
PID 1356 wrote to memory of 1392	1356	rundll32.exe	28
PID 1356 wrote to memory of 1392	1356	rundll32.exe	28
PID 1356 wrote to memory of 1392	1356	rundll32.exe	28
PID 1356 wrote to memory of 1392	1356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0cbef92032f577614231e09fc0c3b97_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0cbef92032f577614231e09fc0c3b97_JaffaCakes118.dll,#1
  2⤵
  PID:1392

memory/1392-0-0x0000000002020000-0x00000000021D4000-memory.dmp

Filesize
1.7MB

Download
memory/1392-1-0x0000000002020000-0x00000000021D4000-memory.dmp

Filesize
1.7MB

Download
memory/1392-2-0x0000000002020000-0x00000000021D4000-memory.dmp

Filesize
1.7MB

Download
memory/1392-3-0x0000000002020000-0x00000000021D4000-memory.dmp

Filesize
1.7MB

Download
memory/1392-4-0x0000000002020000-0x00000000021D4000-memory.dmp

Filesize
1.7MB

Download