c90363ed95f6d50a43661fb8e645465eb469bb76584691371aa4d0b52dc58429

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 04:53

Target

f2bbd88208d3076d25d48f8ad1baa21d_JaffaCakes118.exe
Size

36KB
MD5

f2bbd88208d3076d25d48f8ad1baa21d
SHA1

99e23cdd5528c390d79255576ab1aa23566a322e
SHA256

c90363ed95f6d50a43661fb8e645465eb469bb76584691371aa4d0b52dc58429
SHA512

f4905e44b16887a630779a5f79df5533c122303f412801eb1a1da0bfb5bb3dffefe31c98a8a26733fd947bd84bc9f4149d5e418b09aca535813f0214cde9d331
SSDEEP

768:Xl8xmsqJJZlbgan28pPt6RoPExArDO00q17mN:Xl8xmRJTsa28OiExAWuG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	3988	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	f2bbd88208d3076d25d48f8ad1baa21d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f2bbd88208d3076d25d48f8ad1baa21d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2bbd88208d3076d25d48f8ad1baa21d_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 1756
  2⤵
  - Program crash
  PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3988 -ip 3988
1⤵
PID:3380

memory/3988-1-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/3988-0-0x0000000000DD0000-0x0000000000DE2000-memory.dmp

Filesize
72KB

Download
memory/3988-2-0x00000000057B0000-0x00000000057C0000-memory.dmp

Filesize
64KB

Download
memory/3988-3-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download