507a14989c435bae73940ed0973486becca64269d30240106f09af1156a6fa68

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 11:08

Target

fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe
Size

57KB
MD5

fca02150abbfc2feee3e2e9329fa144e
SHA1

69f62cdb2cd4a2d6efa5d3395a49170059e8b9e3
SHA256

507a14989c435bae73940ed0973486becca64269d30240106f09af1156a6fa68
SHA512

84079137060262b1e147c62099f25e8f96fafa93b5d1e862d9043db5411d8c5bde2b950380b0127dc4809eea7677347ee606fc5b43fc6fa9d896218163d8c78d
SSDEEP

1536:z5Df5eWJ+JSL23F1Aov788o7PC5XOcSptZSvs3EfcVhmBvrNC:z1f5eg+Juzozj2SOcSptnEfghmFNC

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2308	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe
2308	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28
PID 2340 wrote to memory of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28
PID 2340 wrote to memory of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28
PID 2340 wrote to memory of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28
PID 2340 wrote to memory of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28
PID 2340 wrote to memory of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28
PID 2340 wrote to memory of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28
PID 2340 wrote to memory of 2308	2340	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	28
PID 2308 wrote to memory of 1376	2308	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	21
PID 2308 wrote to memory of 1376	2308	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	21
PID 2308 wrote to memory of 1376	2308	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	21
PID 2308 wrote to memory of 1376	2308	fca02150abbfc2feee3e2e9329fa144e_JaffaCakes118.exe	21

memory/1376-8-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1376-12-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2308-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2308-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2308-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2308-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2340-0-0x0000000074B90000-0x000000007513B000-memory.dmp

Filesize
5.7MB

Download
memory/2340-1-0x0000000001F40000-0x0000000001F80000-memory.dmp

Filesize
256KB

Download
memory/2340-2-0x0000000074B90000-0x000000007513B000-memory.dmp

Filesize
5.7MB

Download
memory/2340-6-0x0000000074B90000-0x000000007513B000-memory.dmp

Filesize
5.7MB

Download