2e41e3cf3aaaaa3960f5d61bbef502c820359805e836bee7b46b30c8a038349b

Analysis

max time kernel
131s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 21:41

Target

6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118.dll
Size

787KB
MD5

6c59d8e79b6c69cd3c0668f457d8617e
SHA1

8e7236acd63d5d20bb9272e8e292b6630f802bae
SHA256

2e41e3cf3aaaaa3960f5d61bbef502c820359805e836bee7b46b30c8a038349b
SHA512

399cb0258a1273066c4246445faf06ec4bb3d54098379286ebdb29518a071365c94035a584aa6a0b4f0fe8c32074a88c46edf24fb8bbc5df2accaca4f4c33c95
SSDEEP

24576:uHYmcLLDmoW3Dm+sZ4SY0LX3sRrr35G6Rb15Mbj1fd:u4NLSFYZ5Y8X826uj11

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/916-1-0x0000000074F60000-0x000000007511E000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	916	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 916	4956	rundll32.exe	83
PID 4956 wrote to memory of 916	4956	rundll32.exe	83
PID 4956 wrote to memory of 916	4956	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118.dll,#1
  2⤵
  PID:916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 644
    3⤵
    - Program crash
    PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 916 -ip 916
1⤵
PID:3468

memory/916-1-0x0000000074F60000-0x000000007511E000-memory.dmp

Filesize
1.7MB

Download