184d9e02b96a1add7942f60c6e141856627ad66a1b3294a2a18ddf33afd81cb1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 12:09

Target

3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe
Size

2.8MB
MD5

3a0951a58edc4aeb6a1dfbe30b97ce4a
SHA1

95c2076b2cfddf94ea4ab06ef2d7bee03eb6924e
SHA256

184d9e02b96a1add7942f60c6e141856627ad66a1b3294a2a18ddf33afd81cb1
SHA512

db85e31d020864a38f9488c950a52f486ecec45441d0883e2d9b293741928a4a90eb047ab06663779498b9d3cf1db309db53b48cec7679aef9c8470210ef961a
SSDEEP

49152:/aOI4K8KdG0474yqam//HkJd8wQvhX4zWejg4bGGDKgc7kNTLSYtDzS:SODlTqam//0jQvBtec4TmkD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	2584	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe
Token: 33	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2584	2524	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	28
PID 2584 wrote to memory of 2564	2584	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2564	2584	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2564	2584	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2564	2584	3a0951a58edc4aeb6a1dfbe30b97ce4a_JaffaCakes118.exe	29

memory/2524-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/2524-1-0x00000000013A0000-0x000000000167C000-memory.dmp

Filesize
2.9MB

Download
memory/2524-2-0x0000000000420000-0x000000000043C000-memory.dmp

Filesize
112KB

Download
memory/2524-3-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2524-4-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/2524-5-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2524-20-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2584-19-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2584-11-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2584-17-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2584-6-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2584-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2584-9-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2584-8-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2584-13-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2584-7-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download