43366b9ce51d45a3c3adb29495caf56433b65728c5a4e04fa9f6fe24f82ba555

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 02:04

Target
374bcbee4fca5bbf2a5bae5414700f26_JaffaCakes118.dll
Size 611KB
Sample240711-chpq2ssgrm
SHA256 43366b9ce51d45a3c3adb29495caf56433b65728c5a4e04fa9f6fe24f82ba555
MD5 374bcbee4fca5bbf2a5bae5414700f26
SHA1 756d33ad821b1b16e793b02b221d6d6ef612990a
SHA512 9d379dde6d0ca9610e338de4a0fece28f3920947a4d6d7caa5aa72e640ff2b80950cd8b2c3738169754d3be400350f1b608b2c7cc98d9f5ce8efff42ea1e9850
SSDEEP 12288:frfqGPkxBL/HmsMBKGfZ9B8Whf4Jpak2GbNXvO+P9xk22iAfvbVO:rJPkfGsnO8WizZXrL2BfvZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4488-0-0x0000000010000000-0x00000000101A9000-memory.dmp	vmprotect
behavioral2/memory/4488-1-0x0000000010000000-0x00000000101A9000-memory.dmp	vmprotect
behavioral2/memory/4488-4-0x0000000010000000-0x00000000101A9000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4696	4488	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4488	548	rundll32.exe	83
PID 548 wrote to memory of 4488	548	rundll32.exe	83
PID 548 wrote to memory of 4488	548	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\374bcbee4fca5bbf2a5bae5414700f26_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\374bcbee4fca5bbf2a5bae5414700f26_JaffaCakes118.dll,#1
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 576
    3⤵
    - Program crash
    PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4488 -ip 4488
1⤵
PID:5004

memory/4488-0-0x0000000010000000-0x00000000101A9000-memory.dmp

Download

memory/4488-1-0x0000000010000000-0x00000000101A9000-memory.dmp

Download

memory/4488-4-0x0000000010000000-0x00000000101A9000-memory.dmp

Download