2b7f20c55baff17cb8bbb9f549d964ece8dc72c05804804bb95ab57b19bb7daa

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 14:55

Target

1bbb316ee2c0ab547415ef9da2bbc70e_JaffaCakes118.dll
Size

356KB
MD5

1bbb316ee2c0ab547415ef9da2bbc70e
SHA1

6009bee156918517b753305697763db61b4c0fbd
SHA256

2b7f20c55baff17cb8bbb9f549d964ece8dc72c05804804bb95ab57b19bb7daa
SHA512

f033f5d942f5bf4de68b1a68948d7663ae852cd29f0375d0d6e72303a2a76d8aec5be4f2c834915eef1af879f0ead49796695e0a74201bc64d2992260b6055f2
SSDEEP

6144:MP1inwaCTVE75Xou6Opf1OIzIbNpYZXkAwQ2xWrtOQgUef1MduJ2qMQ:MPawaD1X4+FcNpYpkAwSprgjf1P2qt

Score

7^/10

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral2/memory/3636-2-0x0000000074B10000-0x0000000074BC9000-memory.dmp vmprotect
behavioral2/memory/3636-1-0x0000000074B10000-0x0000000074BC9000-memory.dmp vmprotect

resource	yara_rule
behavioral2/memory/3636-2-0x0000000074B10000-0x0000000074BC9000-memory.dmp	vmprotect
behavioral2/memory/3636-1-0x0000000074B10000-0x0000000074BC9000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3160 wrote to memory of 3636	3160	rundll32.exe	rundll32.exe
PID 3160 wrote to memory of 3636	3160	rundll32.exe	rundll32.exe
PID 3160 wrote to memory of 3636	3160	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bbb316ee2c0ab547415ef9da2bbc70e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bbb316ee2c0ab547415ef9da2bbc70e_JaffaCakes118.dll,#1
2⤵
PID:3636

memory/3636-2-0x0000000074B10000-0x0000000074BC9000-memory.dmp

Filesize
740KB

Download
memory/3636-1-0x0000000074B10000-0x0000000074BC9000-memory.dmp

Filesize
740KB

Download