a39143ea3f3d045d2a93d9a9b0aa4d10a9e3ca22b86348215b5987dd8cc67c7a

Analysis

max time kernel
129s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:31

Target

6926ae0d268331b2835cfdabb413fff7_JaffaCakes118.exe
Size

198KB
MD5

6926ae0d268331b2835cfdabb413fff7
SHA1

3bc7d515a3177a02a8bab2c4912f7536c1926a50
SHA256

a39143ea3f3d045d2a93d9a9b0aa4d10a9e3ca22b86348215b5987dd8cc67c7a
SHA512

df220b7a43da44af00e832a966d7684161cb457f88d2fd8a67984c556edc0a5163cb9d9ded68867076cbb664ab681645325491cf013f452a550eece501daf3c6
SSDEEP

6144:98yBpnl8wDfH/YQs3VF/sAffgBCkDsqQC6JEu:98yhCF/8AkDsZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3744 5044 WerFault.exe 6926ae0d268331b2835cfdabb413fff7_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6926ae0d268331b2835cfdabb413fff7_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 5044 6926ae0d268331b2835cfdabb413fff7_JaffaCakes118.exe

pid	pid_target	process	target process
3744	5044	WerFault.exe	6926ae0d268331b2835cfdabb413fff7_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	5044	6926ae0d268331b2835cfdabb413fff7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6926ae0d268331b2835cfdabb413fff7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6926ae0d268331b2835cfdabb413fff7_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 1456
2⤵
- Program crash
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5044 -ip 5044
1⤵
PID:2508

memory/5044-0-0x000000007445E000-0x000000007445F000-memory.dmp

Filesize
4KB

Download
memory/5044-1-0x0000000000CB0000-0x0000000000CE6000-memory.dmp

Filesize
216KB

Download
memory/5044-2-0x0000000005B70000-0x0000000006114000-memory.dmp

Filesize
5.6MB

Download
memory/5044-3-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/5044-4-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download