2b57a2b8a622aa5ef89e036790e448570a350fb5be4fdb7c7d1d0279420fae27

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 09:20

Target

f9fdd7d81ee155f12836113626ce6526_JaffaCakes118.dll
Size

56KB
MD5

f9fdd7d81ee155f12836113626ce6526
SHA1

a8adfc0ffa651fd08d276f073c239017bb8efd68
SHA256

2b57a2b8a622aa5ef89e036790e448570a350fb5be4fdb7c7d1d0279420fae27
SHA512

f3395aa53d730f9f92f74e0a6a27da95856af827092f7a2e0e36dc25e495734c9d47d90a70160631c10dff4fee8f469f6620410a0b51beccffb2e44e9529efc0
SSDEEP

768:h7QhMER88BiKh4FpPbkGmL4+iezv4HG4grhxxKzHNW2:h7QhS8wfpYGy7iAsA2

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1712-0-0x0000000010000000-0x000000001000F000-memory.dmp	vmprotect
behavioral1/memory/1712-1-0x0000000010000000-0x000000001000F000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9fdd7d81ee155f12836113626ce6526_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9fdd7d81ee155f12836113626ce6526_JaffaCakes118.dll,#1
  2⤵
  PID:1712

memory/1712-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1712-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download