2e41e3cf3aaaaa3960f5d61bbef502c820359805e836bee7b46b30c8a038349b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 21:41

Target

6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118.dll
Size

787KB
MD5

6c59d8e79b6c69cd3c0668f457d8617e
SHA1

8e7236acd63d5d20bb9272e8e292b6630f802bae
SHA256

2e41e3cf3aaaaa3960f5d61bbef502c820359805e836bee7b46b30c8a038349b
SHA512

399cb0258a1273066c4246445faf06ec4bb3d54098379286ebdb29518a071365c94035a584aa6a0b4f0fe8c32074a88c46edf24fb8bbc5df2accaca4f4c33c95
SSDEEP

24576:uHYmcLLDmoW3Dm+sZ4SY0LX3sRrr35G6Rb15Mbj1fd:u4NLSFYZ5Y8X826uj11

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1908-0-0x00000000742F0000-0x00000000744AE000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1908	2856	rundll32.exe	28
PID 2856 wrote to memory of 1908	2856	rundll32.exe	28
PID 2856 wrote to memory of 1908	2856	rundll32.exe	28
PID 2856 wrote to memory of 1908	2856	rundll32.exe	28
PID 2856 wrote to memory of 1908	2856	rundll32.exe	28
PID 2856 wrote to memory of 1908	2856	rundll32.exe	28
PID 2856 wrote to memory of 1908	2856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118.dll,#1
  2⤵
  PID:1908

memory/1908-0-0x00000000742F0000-0x00000000744AE000-memory.dmp

Filesize
1.7MB

Download