1cd18f06f69e00f212bceba4b149eee6ff820e27c3c929f4c315061696069f22

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:46

Target

1b2c1352e87114103ec76996738e3c49_JaffaCakes118.dll
Size

1.5MB
MD5

1b2c1352e87114103ec76996738e3c49
SHA1

398f60ce9087b7cbecd6108eba70c867a8205428
SHA256

1cd18f06f69e00f212bceba4b149eee6ff820e27c3c929f4c315061696069f22
SHA512

7c7f4eacef92f998d75cc31fb05c4d8f1a0fe808862975671c5709f300dfb48ffe649f3406075f2f2c23d8e350d921ecf92da33affd5c132106eb162edff7732
SSDEEP

24576:7qRoXbnVg74xPkmh6EcW2bVMeMGVSu/mWGK1djzXv:tLniMCmh6EcfVMOSkm1K1djLv

Score

7^/10

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/1196-1-0x0000000020000000-0x000000002017D000-memory.dmp	vmprotect
behavioral2/memory/1196-0-0x0000000020000000-0x000000002017D000-memory.dmp	vmprotect
behavioral2/memory/1196-2-0x0000000020000000-0x000000002017D000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1196 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4564 1196 WerFault.exe rundll32.exe

pid	process
1196	rundll32.exe

pid	pid_target	process	target process
4564	1196	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3912 wrote to memory of 1196	3912	rundll32.exe	rundll32.exe
PID 3912 wrote to memory of 1196	3912	rundll32.exe	rundll32.exe
PID 3912 wrote to memory of 1196	3912	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b2c1352e87114103ec76996738e3c49_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b2c1352e87114103ec76996738e3c49_JaffaCakes118.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 612
3⤵
- Program crash
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1196 -ip 1196
1⤵
PID:3420

memory/1196-1-0x0000000020000000-0x000000002017D000-memory.dmp

Filesize
1.5MB

Download
memory/1196-0-0x0000000020000000-0x000000002017D000-memory.dmp

Filesize
1.5MB

Download
memory/1196-2-0x0000000020000000-0x000000002017D000-memory.dmp

Filesize
1.5MB

Download