c42936444650e52d58dd8fbd56f69ccbb7822309ce57dd575e83959fcf0d845f

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 13:00

Target

1a36981330e464dc6571f63a5e43f6a5_JaffaCakes118.dll
Size

724KB
MD5

1a36981330e464dc6571f63a5e43f6a5
SHA1

092e84e3441323fbfbf2eb1dcb555b4f53e55c60
SHA256

c42936444650e52d58dd8fbd56f69ccbb7822309ce57dd575e83959fcf0d845f
SHA512

4f05595bd027d317a2a45b97b3c0d5f8d0939b4133ecec7ec917f5f48911082855ce300e613246bd9241e89522ca779b9adf0a3445d5ed0cb36b66622cbc2834
SSDEEP

12288:7NLMlgQLewMI9BHdQ+rmNMo23S+qGxJHYWLzKNf4Jh0g+vmL3qPYmJpdzNZJ:SHXXHe+rCMNXHYq2kh1byYmL

Score

7^/10

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral2/memory/1204-0-0x0000000010000000-0x000000001015D000-memory.dmp vmprotect
behavioral2/memory/1204-1-0x0000000010000000-0x000000001015D000-memory.dmp vmprotect
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1204 rundll32.exe

resource	yara_rule
behavioral2/memory/1204-0-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect
behavioral2/memory/1204-1-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect

pid	process
1204	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2184 wrote to memory of 1204	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 1204	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 1204	2184	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a36981330e464dc6571f63a5e43f6a5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a36981330e464dc6571f63a5e43f6a5_JaffaCakes118.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1204

memory/1204-0-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download
memory/1204-1-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download