1c00e4bfd00517c910d8a47762c9581aadbe5f976b80cec3b3715086234ffb73

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 11:18

Target

67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe
Size

335KB
MD5

67132677b8e8d68bca712821eb16805a
SHA1

4cc2d919d6fe3cf389be29392d5f05a27a1e1b20
SHA256

1c00e4bfd00517c910d8a47762c9581aadbe5f976b80cec3b3715086234ffb73
SHA512

4a772c977e8c772060e7253305bb0c60211047cd91f26a1d52776c2f708cd84952def87806f495cdfb689e18de61d852a0faf9dc40c36c47c288dac9a84a3ce1
SSDEEP

6144:0NEFZnemsu17En7Hm2GufU0oLPiXLAZJsvt99XC:0N6emB6n7HmVsnoqLADsF2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe

description pid process target process

PID 1340 set thread context of 3804 1340 67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe svchost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4436 3804 WerFault.exe svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1340 67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe

description	pid	process	target process
PID 1340 set thread context of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe

pid	pid_target	process	target process
4436	3804	WerFault.exe	svchost.exe

description	pid	process
Token: SeDebugPrivilege	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe

description	pid	process	target process
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe
PID 1340 wrote to memory of 3804	1340	67132677b8e8d68bca712821eb16805a_JaffaCakes118.exe	svchost.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3804 -ip 3804
1⤵
PID:1960

memory/1340-0-0x0000000074842000-0x0000000074843000-memory.dmp

Filesize
4KB

Download
memory/1340-1-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/1340-2-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/1340-3-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/1340-6-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download