2b57a2b8a622aa5ef89e036790e448570a350fb5be4fdb7c7d1d0279420fae27

Analysis

max time kernel
94s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 09:20

Target

f9fdd7d81ee155f12836113626ce6526_JaffaCakes118.dll
Size

56KB
MD5

f9fdd7d81ee155f12836113626ce6526
SHA1

a8adfc0ffa651fd08d276f073c239017bb8efd68
SHA256

2b57a2b8a622aa5ef89e036790e448570a350fb5be4fdb7c7d1d0279420fae27
SHA512

f3395aa53d730f9f92f74e0a6a27da95856af827092f7a2e0e36dc25e495734c9d47d90a70160631c10dff4fee8f469f6620410a0b51beccffb2e44e9529efc0
SSDEEP

768:h7QhMER88BiKh4FpPbkGmL4+iezv4HG4grhxxKzHNW2:h7QhS8wfpYGy7iAsA2

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4896-0-0x0000000010000000-0x000000001000F000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4896	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4896	3880	rundll32.exe	85
PID 3880 wrote to memory of 4896	3880	rundll32.exe	85
PID 3880 wrote to memory of 4896	3880	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9fdd7d81ee155f12836113626ce6526_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9fdd7d81ee155f12836113626ce6526_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4896

memory/4896-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download