e977b8a70dad3a41b696a47cb9567478be9c389b464b725364b388b54fbf3b94

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:42

Target

0613b3bda683c88e3232da4c4605fae8_JaffaCakes118.dll
Size

611KB
MD5

0613b3bda683c88e3232da4c4605fae8
SHA1

b72fd908cf11602a71801adac7b3133ddae2058e
SHA256

e977b8a70dad3a41b696a47cb9567478be9c389b464b725364b388b54fbf3b94
SHA512

8353f839164ef4b326eb0d3271dc679b2ff51202037463bae83939eceb7ea2a8a8c128d15d61e3503289a188e8655afaae16858fff083e6000fe6e1f7568830b
SSDEEP

12288:o5yMrLVmeIqzPHJmJTGpEgdnxv3u3vIycvKEEBo4njUc+YR:9IrXIti+vIFknjUi

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/3016-0-0x0000000010000000-0x00000000100E8000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3016	2932	rundll32.exe	28
PID 2932 wrote to memory of 3016	2932	rundll32.exe	28
PID 2932 wrote to memory of 3016	2932	rundll32.exe	28
PID 2932 wrote to memory of 3016	2932	rundll32.exe	28
PID 2932 wrote to memory of 3016	2932	rundll32.exe	28
PID 2932 wrote to memory of 3016	2932	rundll32.exe	28
PID 2932 wrote to memory of 3016	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0613b3bda683c88e3232da4c4605fae8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0613b3bda683c88e3232da4c4605fae8_JaffaCakes118.dll,#1
  2⤵
  PID:3016

memory/3016-0-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download
memory/3016-1-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download