7c2b2b4bda942b33b9b6f559270cc8f97a738b4367bfac5d713dec40de7690a9

Analysis

max time kernel
139s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 04:06

Target
0fa1787ff4d989061b2a14fb14216159_JaffaCakes118.exe
Size 299KB
Sample240503-epa8caef6y
SHA256 7c2b2b4bda942b33b9b6f559270cc8f97a738b4367bfac5d713dec40de7690a9
MD5 0fa1787ff4d989061b2a14fb14216159
SHA1 1de00155b51368a2b521ac36ede7201e1ebb5ad6
SHA512 c9e43be2c137b35daf7e7bd64791c9c90e5b079904473c711ba937457660206b20bfa77f0c9b3c7376c0c8460f57c19cff25dd789585b3f2f34d652c2670906c
SSDEEP 6144:Etip4PGDB1Df9F+rn3GQ7P1pVu0bOQiERUUdfxsO:WZN79p7TEk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	2868	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	0fa1787ff4d989061b2a14fb14216159_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0fa1787ff4d989061b2a14fb14216159_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fa1787ff4d989061b2a14fb14216159_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 824
  2⤵
  - Program crash
  PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2868 -ip 2868
1⤵
PID:2720

memory/2868-0-0x0000000074B6E000-0x0000000074B6F000-memory.dmp

Download

memory/2868-1-0x0000000000060000-0x00000000000B2000-memory.dmp

Download