ceb8a142368fe02aa182aaff25d9cdca7ef7d93e6d5e8add934dfa22793b3b2a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:44

Target
a523df51a98c399654ff3b5545ca0b3a_JaffaCakes118.dll
Size 292KB
Sample240613-ms32javgnc
SHA256 ceb8a142368fe02aa182aaff25d9cdca7ef7d93e6d5e8add934dfa22793b3b2a
MD5 a523df51a98c399654ff3b5545ca0b3a
SHA1 d366fc16ccc4548e103a29d556cc56de06500e83
SHA512 c3157e55d2b6c8eb0a4e7a6206f95907022dec369a1a8855f984108a3fd791a144084bd705e684cfb8f34cedb6d0ae197d660b90e57e84b159c3a08a91691b0d
SSDEEP 6144:pMFMN9NEbW9xqC8acxnEW49NneDUYsUWoLmRzz0+7qZOMHSWFN:vKi8aDW49NeDUYfWoLc0+eRyg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1848-1-0x0000000010000000-0x0000000010165000-memory.dmp	vmprotect
behavioral2/memory/1848-0-0x0000000010000000-0x0000000010165000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1848	1564	rundll32.exe	82
PID 1564 wrote to memory of 1848	1564	rundll32.exe	82
PID 1564 wrote to memory of 1848	1564	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a523df51a98c399654ff3b5545ca0b3a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a523df51a98c399654ff3b5545ca0b3a_JaffaCakes118.dll,#1
  2⤵
  PID:1848

memory/1848-1-0x0000000010000000-0x0000000010165000-memory.dmp

Download

memory/1848-0-0x0000000010000000-0x0000000010165000-memory.dmp

Download