bc8a4b3db03b04a56a11cae45079bc9dfcf0ed24e6139407aed1b6d12da4f183

Analysis

max time kernel
0s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 07:05

Target

f53e79f1c3bbeea144b6828b0976d7ad_JaffaCakes118.exe
Size

28KB
MD5

f53e79f1c3bbeea144b6828b0976d7ad
SHA1

10604e4cf2336217a3c28b19fd3ae8c4e0ba2dfd
SHA256

bc8a4b3db03b04a56a11cae45079bc9dfcf0ed24e6139407aed1b6d12da4f183
SHA512

242e19778ec2aade4d94e06a5b90889aa4c6f25ec22099529337f30654eea7a75196d117924044636fb1d23157ada65215a5a920a7a637f4c3527e9fbd55d82f
SSDEEP

384:HZo6yDXJRQPByrbRLbGpTQcsxdiXGVbEXIn2rT+rPOUS0bSJG5EN++:HZo6yDXroQlGpMEXME4n2rT70uXt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3112	3148	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	f53e79f1c3bbeea144b6828b0976d7ad_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3148	f53e79f1c3bbeea144b6828b0976d7ad_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f53e79f1c3bbeea144b6828b0976d7ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f53e79f1c3bbeea144b6828b0976d7ad_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 360
  2⤵
  - Program crash
  PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3148 -ip 3148
1⤵
PID:5076