42bd931dbea40b9c8c5c6b38d264dc758ef49de39eca768e47e679f1ed76e043

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 10:37

Target

fc90927480d18638913a4ad758676337_JaffaCakes118.exe
Size

9KB
MD5

fc90927480d18638913a4ad758676337
SHA1

2b44a9446267f62ef421cdfffabe27c434226ece
SHA256

42bd931dbea40b9c8c5c6b38d264dc758ef49de39eca768e47e679f1ed76e043
SHA512

bbe7d0e0820ba2bf6b7129e9ab5d66fb4ae38d796f661877899f0426465207c9c1d7bf51dab6a7746c8cade39ea7f45d36db6a0d2c17a8438fec1c86f88215f1
SSDEEP

192:cBksuv9MuIUWheMZZ3R93VnjdwqzZ38tL9a:dlAheMrFnhwq1stL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	fc90927480d18638913a4ad758676337_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2612	2904	fc90927480d18638913a4ad758676337_JaffaCakes118.exe	28
PID 2904 wrote to memory of 2612	2904	fc90927480d18638913a4ad758676337_JaffaCakes118.exe	28
PID 2904 wrote to memory of 2612	2904	fc90927480d18638913a4ad758676337_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fc90927480d18638913a4ad758676337_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc90927480d18638913a4ad758676337_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2904 -s 896
  2⤵
  PID:2612

memory/2904-0-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/2904-1-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Filesize
9.9MB

Download
memory/2904-2-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download
memory/2904-3-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Filesize
9.9MB

Download
memory/2904-4-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download