cc2cea15b26e58d46bea59c5312e09c58b431ea522f8df4049d7d9887f4563c8

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 10:17

Target

1ae8fd3a9e0ff568733376115134d7f9_JaffaCakes118.dll
Size

788KB
MD5

1ae8fd3a9e0ff568733376115134d7f9
SHA1

faa673644eecad9e2f1136af4d02f05f81d65313
SHA256

cc2cea15b26e58d46bea59c5312e09c58b431ea522f8df4049d7d9887f4563c8
SHA512

83f00898641e9af028bb5e25a0dd9125603376cdfa2bde100b0638e8193e582dc96d10b1dfb1dceadfdbeaebdd98aac0d2a852f67b016b242ae9077e275713f0
SSDEEP

24576:BXvVXFsSZFzYghVyY1R2jQ27w238o3vPJ:BN1rZ1h3jgp9so3p

Score

7^/10

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral2/memory/3604-0-0x0000000010000000-0x0000000010204000-memory.dmp vmprotect
behavioral2/memory/3604-1-0x0000000010000000-0x0000000010204000-memory.dmp vmprotect
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3604 rundll32.exe
3604 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 3604 rundll32.exe
Token: 33 3604 rundll32.exe
Token: SeIncBasePriorityPrivilege 3604 rundll32.exe

resource	yara_rule
behavioral2/memory/3604-0-0x0000000010000000-0x0000000010204000-memory.dmp	vmprotect
behavioral2/memory/3604-1-0x0000000010000000-0x0000000010204000-memory.dmp	vmprotect

description	pid	process
Token: SeDebugPrivilege	3604	rundll32.exe
Token: 33	3604	rundll32.exe
Token: SeIncBasePriorityPrivilege	3604	rundll32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2532 wrote to memory of 3604	2532	rundll32.exe	rundll32.exe
PID 2532 wrote to memory of 3604	2532	rundll32.exe	rundll32.exe
PID 2532 wrote to memory of 3604	2532	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae8fd3a9e0ff568733376115134d7f9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532

memory/3604-0-0x0000000010000000-0x0000000010204000-memory.dmp

Filesize
2.0MB

Download
memory/3604-1-0x0000000010000000-0x0000000010204000-memory.dmp

Filesize
2.0MB

Download