92172de098be4ecf2769b58cc3702804ccfdba304a6166d1309168453231ef8f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 11:59

Target

086136b080c56f76001685eba5998b73_JaffaCakes118.dll
Size

553KB
MD5

086136b080c56f76001685eba5998b73
SHA1

e29255c2a8faba8d61ac837a17109f034deeff00
SHA256

92172de098be4ecf2769b58cc3702804ccfdba304a6166d1309168453231ef8f
SHA512

8adac1675729e0bdce5b01a6a236db372abccdce41e78e0452ac478dc465b263f12e175c8fea3071c3b5f1be166ca027b4d38b6c23aecdb683729d7147fb375c
SSDEEP

12288:A3fvpRCfv+9EJlxpXdSkiMKEYmasCWtlNtE7kckGYNbGI/5C0UTQ/wJEt:4m3++JbpNSl6eWrN+gJT5C0UTQ/wJU

Score

7^/10

vmprotect

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2200-3-0x0000000010000000-0x0000000010170000-memory.dmp	vmprotect
behavioral1/memory/2200-2-0x0000000010000000-0x0000000010170000-memory.dmp	vmprotect
behavioral1/memory/2200-1-0x0000000010000000-0x0000000010170000-memory.dmp	vmprotect
behavioral1/memory/2200-0-0x0000000010000000-0x0000000010170000-memory.dmp	vmprotect
behavioral1/memory/2200-4-0x0000000010000000-0x0000000010170000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2200	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	rundll32.exe
2200	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2200	2540	rundll32.exe	28
PID 2540 wrote to memory of 2200	2540	rundll32.exe	28
PID 2540 wrote to memory of 2200	2540	rundll32.exe	28
PID 2540 wrote to memory of 2200	2540	rundll32.exe	28
PID 2540 wrote to memory of 2200	2540	rundll32.exe	28
PID 2540 wrote to memory of 2200	2540	rundll32.exe	28
PID 2540 wrote to memory of 2200	2540	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\086136b080c56f76001685eba5998b73_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\086136b080c56f76001685eba5998b73_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2200

memory/2200-3-0x0000000010000000-0x0000000010170000-memory.dmp

Filesize
1.4MB

Download
memory/2200-5-0x0000000010160000-0x0000000010161000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x0000000010000000-0x0000000010170000-memory.dmp

Filesize
1.4MB

Download
memory/2200-1-0x0000000010000000-0x0000000010170000-memory.dmp

Filesize
1.4MB

Download
memory/2200-0-0x0000000010000000-0x0000000010170000-memory.dmp

Filesize
1.4MB

Download
memory/2200-4-0x0000000010000000-0x0000000010170000-memory.dmp

Filesize
1.4MB

Download