ad839f51d5eec6b15713375ee792fed9aefc559fb13333aadcd542a76d85b73b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:01

Target

4a9638c553f13ed398588e77eec49dc4_JaffaCakes118.dll
Size

828KB
MD5

4a9638c553f13ed398588e77eec49dc4
SHA1

e5237f300f5c2c69c5153f4643dc4c759c9668db
SHA256

ad839f51d5eec6b15713375ee792fed9aefc559fb13333aadcd542a76d85b73b
SHA512

435e8faa7d6bf91d8871815414dd148f819be03035d2766d8afebc1b9adefb7d8f09d8fc99dae75db23823c8ec55db97a9398c142595d4fbf6eeac5e0aae4ea3
SSDEEP

24576:qRWuzyd7PKY4RlvNwsDfLztB3w7ZujxrYHMCRQfElHun:HgyRiYIn5DfL73nNrYfQME

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2840-2-0x0000000010000000-0x0000000010242000-memory.dmp	vmprotect
behavioral1/memory/2840-1-0x0000000010000000-0x0000000010242000-memory.dmp	vmprotect
behavioral1/memory/2840-0-0x0000000010000000-0x0000000010242000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2840	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2840	2752	rundll32.exe	30
PID 2752 wrote to memory of 2840	2752	rundll32.exe	30
PID 2752 wrote to memory of 2840	2752	rundll32.exe	30
PID 2752 wrote to memory of 2840	2752	rundll32.exe	30
PID 2752 wrote to memory of 2840	2752	rundll32.exe	30
PID 2752 wrote to memory of 2840	2752	rundll32.exe	30
PID 2752 wrote to memory of 2840	2752	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a9638c553f13ed398588e77eec49dc4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a9638c553f13ed398588e77eec49dc4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2840

memory/2840-2-0x0000000010000000-0x0000000010242000-memory.dmp

Filesize
2.3MB

Download
memory/2840-1-0x0000000010000000-0x0000000010242000-memory.dmp

Filesize
2.3MB

Download
memory/2840-0-0x0000000010000000-0x0000000010242000-memory.dmp

Filesize
2.3MB

Download