ad839f51d5eec6b15713375ee792fed9aefc559fb13333aadcd542a76d85b73b

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 17:01

Target

4a9638c553f13ed398588e77eec49dc4_JaffaCakes118.dll
Size

828KB
MD5

4a9638c553f13ed398588e77eec49dc4
SHA1

e5237f300f5c2c69c5153f4643dc4c759c9668db
SHA256

ad839f51d5eec6b15713375ee792fed9aefc559fb13333aadcd542a76d85b73b
SHA512

435e8faa7d6bf91d8871815414dd148f819be03035d2766d8afebc1b9adefb7d8f09d8fc99dae75db23823c8ec55db97a9398c142595d4fbf6eeac5e0aae4ea3
SSDEEP

24576:qRWuzyd7PKY4RlvNwsDfLztB3w7ZujxrYHMCRQfElHun:HgyRiYIn5DfL73nNrYfQME

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/5072-0-0x0000000010000000-0x0000000010242000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5072	4804	rundll32.exe	83
PID 4804 wrote to memory of 5072	4804	rundll32.exe	83
PID 4804 wrote to memory of 5072	4804	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a9638c553f13ed398588e77eec49dc4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a9638c553f13ed398588e77eec49dc4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5072

memory/5072-0-0x0000000010000000-0x0000000010242000-memory.dmp

Filesize
2.3MB

Download