a54f387189c2fe5310fd6a8617e4248e47da6c926ce12a41c3c2c86042fc9a4a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 19:00

Target

7a2d4c22005397950bcd4659dd8ec249_JaffaCakes118.exe
Size

608KB
MD5

7a2d4c22005397950bcd4659dd8ec249
SHA1

2d499bed22cd2ae2155bd132b26bf0949b8c57e8
SHA256

a54f387189c2fe5310fd6a8617e4248e47da6c926ce12a41c3c2c86042fc9a4a
SHA512

61cd03a6150814893a362b266c8d9a55d77be4dafe07a4310e33e806f7d6164aabcc7ed8d82a2f07269ecfe78080d25d2dbae0217b352d36b2f597c0cffeb3b5
SSDEEP

12288:fygkAq2LlrrJQ4y2N6avIj/RAGX7aF6LXpsWW2BQdi9j:qnGBQYoavIdAExX2Wki9j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	620	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	7a2d4c22005397950bcd4659dd8ec249_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 2604	620	7a2d4c22005397950bcd4659dd8ec249_JaffaCakes118.exe	28
PID 620 wrote to memory of 2604	620	7a2d4c22005397950bcd4659dd8ec249_JaffaCakes118.exe	28
PID 620 wrote to memory of 2604	620	7a2d4c22005397950bcd4659dd8ec249_JaffaCakes118.exe	28
PID 620 wrote to memory of 2604	620	7a2d4c22005397950bcd4659dd8ec249_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\7a2d4c22005397950bcd4659dd8ec249_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7a2d4c22005397950bcd4659dd8ec249_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 1264
  2⤵
  - Program crash
  PID:2604

memory/620-0-0x000000007493E000-0x000000007493F000-memory.dmp

Filesize
4KB

Download
memory/620-1-0x0000000001170000-0x0000000001212000-memory.dmp

Filesize
648KB

Download
memory/620-2-0x0000000000A60000-0x0000000000ACA000-memory.dmp

Filesize
424KB

Download
memory/620-3-0x00000000003B0000-0x00000000003CC000-memory.dmp

Filesize
112KB

Download
memory/620-4-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/620-5-0x000000007493E000-0x000000007493F000-memory.dmp

Filesize
4KB

Download
memory/620-6-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download