909a3dfca4c1a9f392a27d76d9e84c71b04994f271aef608344d0211823b60d7

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:31

Target

1b212040f074d2cb1427f81f59075ce1_JaffaCakes118.dll
Size

5.4MB
MD5

1b212040f074d2cb1427f81f59075ce1
SHA1

f1b796868e6c02dd5fc4f31572abd67c1afb9c76
SHA256

909a3dfca4c1a9f392a27d76d9e84c71b04994f271aef608344d0211823b60d7
SHA512

0faa3782c2af58cd381cc1e7ff281dba6cffb58e36f75197d41fc442d30ad77c7605f3ea8d92d20bda0249ed63756798ea009ef331e00ad7f5d84f9087b49619
SSDEEP

98304:DXEs8Ca0XPke8RcX+dWHW5+r+JuHac1DL5dBMScy8MZLTzgX:gExsqlZu3sddFcy82zgX

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

4 2236 rundll32.exe

flow	pid	process
4	2236	rundll32.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2236-11-0x0000000072F50000-0x0000000073830000-memory.dmp	vmprotect
behavioral1/memory/2236-13-0x0000000072F50000-0x0000000073830000-memory.dmp	vmprotect
behavioral1/memory/2236-14-0x0000000072F50000-0x0000000073830000-memory.dmp	vmprotect
behavioral1/memory/2236-16-0x0000000072F50000-0x0000000073830000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2236 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2236 rundll32.exe
2236 rundll32.exe

pid	process
2236	rundll32.exe

pid	process
2236	rundll32.exe
2236	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2736 wrote to memory of 2236	2736	rundll32.exe	rundll32.exe
PID 2736 wrote to memory of 2236	2736	rundll32.exe	rundll32.exe
PID 2736 wrote to memory of 2236	2736	rundll32.exe	rundll32.exe
PID 2736 wrote to memory of 2236	2736	rundll32.exe	rundll32.exe
PID 2736 wrote to memory of 2236	2736	rundll32.exe	rundll32.exe
PID 2736 wrote to memory of 2236	2736	rundll32.exe	rundll32.exe
PID 2736 wrote to memory of 2236	2736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b212040f074d2cb1427f81f59075ce1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736

memory/2236-0-0x0000000072F9E000-0x00000000732C9000-memory.dmp

Filesize
3.2MB

Download
memory/2236-10-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2236-11-0x0000000072F50000-0x0000000073830000-memory.dmp

Filesize
8.9MB

Download
memory/2236-13-0x0000000072F50000-0x0000000073830000-memory.dmp

Filesize
8.9MB

Download
memory/2236-8-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2236-6-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2236-5-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2236-3-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2236-14-0x0000000072F50000-0x0000000073830000-memory.dmp

Filesize
8.9MB

Download
memory/2236-15-0x0000000072F9E000-0x00000000732C9000-memory.dmp

Filesize
3.2MB

Download
memory/2236-16-0x0000000072F50000-0x0000000073830000-memory.dmp

Filesize
8.9MB

Download