97e9f31062cca05f9b380ef66629e707ce0f8d4f8cb10d1027dac081c3e88758

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 08:36

Target

ed012df3ec050a4816500ce8242d3397_JaffaCakes118.exe
Size

338KB
MD5

ed012df3ec050a4816500ce8242d3397
SHA1

507198b268c6c22253874864a5f1a679cdd48ca0
SHA256

97e9f31062cca05f9b380ef66629e707ce0f8d4f8cb10d1027dac081c3e88758
SHA512

a3ad859355f07679659162bb2d28e48d9f6b7b04ef4e6b9e7aa0c229a1d1803be5bd1c82b04b008c9c6e2e5d1170b6f62e39c51df61cd9b1715e4cd35099c981
SSDEEP

6144:1HUCw6pg4XLrn8W+O1Q10fVJXGYE6dgeoo/Pevfx0SJ:zw6pgeLrBViOV1GYzqvoeOy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	3040	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	ed012df3ec050a4816500ce8242d3397_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2116	3040	ed012df3ec050a4816500ce8242d3397_JaffaCakes118.exe	29
PID 3040 wrote to memory of 2116	3040	ed012df3ec050a4816500ce8242d3397_JaffaCakes118.exe	29
PID 3040 wrote to memory of 2116	3040	ed012df3ec050a4816500ce8242d3397_JaffaCakes118.exe	29
PID 3040 wrote to memory of 2116	3040	ed012df3ec050a4816500ce8242d3397_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\ed012df3ec050a4816500ce8242d3397_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed012df3ec050a4816500ce8242d3397_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1212
  2⤵
  - Program crash
  PID:2116

memory/3040-0-0x0000000001010000-0x000000000106A000-memory.dmp

Filesize
360KB

Download
memory/3040-1-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-2-0x0000000004940000-0x0000000004980000-memory.dmp

Filesize
256KB

Download
memory/3040-3-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download
memory/3040-4-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-5-0x0000000004940000-0x0000000004980000-memory.dmp

Filesize
256KB

Download
memory/3040-6-0x0000000004D60000-0x0000000004DC6000-memory.dmp

Filesize
408KB

Download
memory/3040-7-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download