e85685c93532eeb713c582b6d8bcab3f152323d175a122de2b4c6669d5330e42

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:22

Target

59e30a49b86ccc9d4854098176d3eeee_JaffaCakes118.dll
Size

880KB
MD5

59e30a49b86ccc9d4854098176d3eeee
SHA1

9bd942356b70e8e2e286a6baccc112bb6f43cdad
SHA256

e85685c93532eeb713c582b6d8bcab3f152323d175a122de2b4c6669d5330e42
SHA512

a966493869dcf7cd3c4e9a58681ca196208314f3a52948ba5145a5218c3e8a63bb5587861cb8a60ec3267fc6796da855c89cfda86e1ed8eb2391e2573303f28e
SSDEEP

24576:iNz9VSd4pFu60asvWjOtM7p8AkP1EAJR4UHVNoEPI6:ibVSd4pFu60asuKy7puEAJR4w1I6

Score

7^/10

vmprotect

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2060-3-0x0000000010000000-0x0000000010222000-memory.dmp	vmprotect
behavioral1/memory/2060-2-0x0000000010000000-0x0000000010222000-memory.dmp	vmprotect
behavioral1/memory/2060-1-0x0000000010000000-0x0000000010222000-memory.dmp	vmprotect
behavioral1/memory/2060-0-0x0000000010000000-0x0000000010222000-memory.dmp	vmprotect
behavioral1/memory/2060-4-0x0000000010000000-0x0000000010222000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2060	rundll32.exe

Suspicious use of SetWindowsHookEx 37 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2060	2968	rundll32.exe	30
PID 2968 wrote to memory of 2060	2968	rundll32.exe	30
PID 2968 wrote to memory of 2060	2968	rundll32.exe	30
PID 2968 wrote to memory of 2060	2968	rundll32.exe	30
PID 2968 wrote to memory of 2060	2968	rundll32.exe	30
PID 2968 wrote to memory of 2060	2968	rundll32.exe	30
PID 2968 wrote to memory of 2060	2968	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e30a49b86ccc9d4854098176d3eeee_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e30a49b86ccc9d4854098176d3eeee_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:2060

memory/2060-3-0x0000000010000000-0x0000000010222000-memory.dmp

Filesize
2.1MB

Download
memory/2060-2-0x0000000010000000-0x0000000010222000-memory.dmp

Filesize
2.1MB

Download
memory/2060-1-0x0000000010000000-0x0000000010222000-memory.dmp

Filesize
2.1MB

Download
memory/2060-0-0x0000000010000000-0x0000000010222000-memory.dmp

Filesize
2.1MB

Download
memory/2060-4-0x0000000010000000-0x0000000010222000-memory.dmp

Filesize
2.1MB

Download