16b8a5f769825180167b3020cbb4440b8334c3d063035d55b8aa32b7162dedaf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 04:48

Target

4848d974f43834464999457bf79441be_JaffaCakes118.dll
Size

72KB
MD5

4848d974f43834464999457bf79441be
SHA1

23c6382d03d2c325b2c07e2079ced1354a4df674
SHA256

16b8a5f769825180167b3020cbb4440b8334c3d063035d55b8aa32b7162dedaf
SHA512

05fe9e4b11e3eb80e181af64bc285ebd7d60234631ded67f0b8bee1759dd19265503775545cf2d844d05f8114c573c3ca2267f81b2263997cf139fc2781e10f5
SSDEEP

1536:6QDIO81Q0E7UJAEvlYuDmjRYPxxrVBj2Ou9f64J2LcMPMVCKBUxFBgp:6yIxE7UJAu9DOoL7m5F2LdkVDBhp

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1220-0-0x0000000010000000-0x0000000010043000-memory.dmp	vmprotect
behavioral2/memory/1220-1-0x0000000010000000-0x0000000010043000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	1220	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1220	2756	rundll32.exe	83
PID 2756 wrote to memory of 1220	2756	rundll32.exe	83
PID 2756 wrote to memory of 1220	2756	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4848d974f43834464999457bf79441be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4848d974f43834464999457bf79441be_JaffaCakes118.dll,#1
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 636
    3⤵
    - Program crash
    PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1220 -ip 1220
1⤵
PID:4660

memory/1220-0-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1220-1-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download