6f18b0f2f3ea8e9e6aa8dca80d446b4e6bbb37fc68df36e831ce270c67def40a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 10:11

Target

1ae48fa2e2276cb696b7aa69321fca64_JaffaCakes118.dll
Size

724KB
MD5

1ae48fa2e2276cb696b7aa69321fca64
SHA1

7620defb9caa61a7c369478b9a9eda9fc76566f0
SHA256

6f18b0f2f3ea8e9e6aa8dca80d446b4e6bbb37fc68df36e831ce270c67def40a
SHA512

dac5cadc93a62dfea8474e0440810d1e1a0fe856011685cecff1ca58811e25741ab203e9d1d85c19789af732e9d2fc2e9e140e7f01795ab6867ab7a58e4fd836
SSDEEP

12288:7NLMlgQLewMI9BHdQ+rmNMo23S+qGxJHYWLzKNf4Jh0g+vmL3qPYmJpdzNZF:SHXXHe+rCMNXHYq2kh1byYm/

Score

7^/10

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/876-3-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect
behavioral1/memory/876-4-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect
behavioral1/memory/876-2-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect
behavioral1/memory/876-1-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect
behavioral1/memory/876-0-0x0000000010000000-0x000000001015D000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

876 rundll32.exe

pid	process
876	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2392 wrote to memory of 876	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 876	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 876	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 876	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 876	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 876	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 876	2392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae48fa2e2276cb696b7aa69321fca64_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae48fa2e2276cb696b7aa69321fca64_JaffaCakes118.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:876

memory/876-3-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download
memory/876-4-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download
memory/876-2-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download
memory/876-1-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download
memory/876-0-0x0000000010000000-0x000000001015D000-memory.dmp

Filesize
1.4MB

Download