ab4e53950c0f5c143f27de56397526c19ae4a522f5789a4a3bdd3beff46fd0dd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 12:05

Target

d33f3911bb80d867f022d0ae48e426c9_JaffaCakes118.exe
Size

129KB
MD5

d33f3911bb80d867f022d0ae48e426c9
SHA1

58c0effa803692edfba3926f6c72381c2b326040
SHA256

ab4e53950c0f5c143f27de56397526c19ae4a522f5789a4a3bdd3beff46fd0dd
SHA512

fc2fea6101681ae15e0a96aa406a23efa2c081d75c60fcdac7e756440b44644f95b935628c16a444a22df2818c2d7678645b9faffe2959eba6bf6421aa5bc67c
SSDEEP

3072:6Dg1ob8S0h0CTXYmvFMQ4b1LfIH6wz4oJnnsq2xc150:6sg8S0hYmuQ4pfpoJnnsjxC0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	d33f3911bb80d867f022d0ae48e426c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2888	1964	d33f3911bb80d867f022d0ae48e426c9_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2888	1964	d33f3911bb80d867f022d0ae48e426c9_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2888	1964	d33f3911bb80d867f022d0ae48e426c9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\d33f3911bb80d867f022d0ae48e426c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d33f3911bb80d867f022d0ae48e426c9_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 968
  2⤵
  PID:2888

memory/1964-0-0x00000000003A0000-0x00000000003BA000-memory.dmp

Filesize
104KB

Download
memory/1964-1-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/1964-3-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/1964-2-0x000000001AF70000-0x000000001AFF0000-memory.dmp

Filesize
512KB

Download
memory/1964-4-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/1964-5-0x000000001AF70000-0x000000001AFF0000-memory.dmp

Filesize
512KB

Download