3d96ff479d9da2929769671c2ebb4787ecbce7b008b636abcc7cd6a31bdda329

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 10:03

Target

f0cbef92032f577614231e09fc0c3b97_JaffaCakes118.dll
Size

740KB
MD5

f0cbef92032f577614231e09fc0c3b97
SHA1

61174ae52afadb9e9eed530975f52a3491bf5a10
SHA256

3d96ff479d9da2929769671c2ebb4787ecbce7b008b636abcc7cd6a31bdda329
SHA512

abe4504a01d9e9e406fded58bd5d7cdfdfca78e42f9ecab5f8beb951623e9dbfff40a640bd18687c4e468ac3422829268781a0524efe2f74ea79b1be0c9fe899
SSDEEP

12288:Af68zjnT+2a8+p0/IARbJkale360zCA9JK7LdBzSZd6Z/+rXm5AQKa8/VyFcajNp:Ajjny2a8S0/1EaleYUKn2ZY2TmAQN0Vi

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4812-0-0x0000000000400000-0x00000000005B4000-memory.dmp	vmprotect
behavioral2/memory/4812-1-0x0000000000400000-0x00000000005B4000-memory.dmp	vmprotect
behavioral2/memory/4812-2-0x0000000000400000-0x00000000005B4000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4812	1904	rundll32.exe	90
PID 1904 wrote to memory of 4812	1904	rundll32.exe	90
PID 1904 wrote to memory of 4812	1904	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0cbef92032f577614231e09fc0c3b97_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0cbef92032f577614231e09fc0c3b97_JaffaCakes118.dll,#1
  2⤵
  PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:1168

memory/4812-0-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/4812-1-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/4812-2-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download