3ea09605da7dd2f573b7879ca6105134128018529bb721afe4a003b2b97bb5e4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:05

Target

1a8938ccb022561f26e2c3fba9e64824_JaffaCakes118.dll
Size

724KB
MD5

1a8938ccb022561f26e2c3fba9e64824
SHA1

427d0f4d67b71ff5bddd7ab9812693744eeead6b
SHA256

3ea09605da7dd2f573b7879ca6105134128018529bb721afe4a003b2b97bb5e4
SHA512

6427d1beb5a57a4f7a3e77adcce71cb73113d3ad16aa677fe6f116a5a6ffcd6705ce0f13b7fd1a8201d5f5cbeca766ed34625471653845251ffd7dce1f211d30
SSDEEP

12288:7NLMlgQLewMI9BHdQ+rmNMo23S+qGxJHYWLzKNf4Jh0g+vmL3qPYmJpdzNZv:SHXXHe+rCMNXHYq2kh1byYmF

Score

7^/10

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral2/memory/4336-0-0x0000000010000000-0x000000001015D000-memory.dmp vmprotect
behavioral2/memory/4336-1-0x0000000010000000-0x000000001015D000-memory.dmp vmprotect
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

4336 rundll32.exe

resource	yara_rule
behavioral2/memory/4336-0-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect
behavioral2/memory/4336-1-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect

pid	process
4336	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 4336	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 4336	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 4336	1652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8938ccb022561f26e2c3fba9e64824_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8938ccb022561f26e2c3fba9e64824_JaffaCakes118.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4336

memory/4336-0-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download
memory/4336-1-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download