463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 07:13

Target

7c22531ea58fe480003d63a5cf8a1430_JaffaCakes118.exe
Size

141KB
MD5

7c22531ea58fe480003d63a5cf8a1430
SHA1

76f979c71a75e20d6f8f316126e3badb17b33b20
SHA256

463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1
SHA512

6d2355984fd2d3dac55ade9e7c8436fc71a5b293295b21b01d83433d091eb0dcf08d06015fa85912cb7e8bce8bf7ee1c328ac71205f7d638f4b43d9fd19f39b2
SSDEEP

3072:0sRsmdwCA4t0v0KrOx7W1zhdNqnbM4MnHOIdYOY/5AnKA0B2P:0sRsUrtSr+7adN2jETLY2KXB2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	2732	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	7c22531ea58fe480003d63a5cf8a1430_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2084	2732	7c22531ea58fe480003d63a5cf8a1430_JaffaCakes118.exe	28
PID 2732 wrote to memory of 2084	2732	7c22531ea58fe480003d63a5cf8a1430_JaffaCakes118.exe	28
PID 2732 wrote to memory of 2084	2732	7c22531ea58fe480003d63a5cf8a1430_JaffaCakes118.exe	28
PID 2732 wrote to memory of 2084	2732	7c22531ea58fe480003d63a5cf8a1430_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\7c22531ea58fe480003d63a5cf8a1430_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7c22531ea58fe480003d63a5cf8a1430_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 1016
  2⤵
  - Program crash
  PID:2084

memory/2732-0-0x00000000743AE000-0x00000000743AF000-memory.dmp

Filesize
4KB

Download
memory/2732-1-0x0000000000B40000-0x0000000000B6C000-memory.dmp

Filesize
176KB

Download
memory/2732-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2732-3-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-4-0x0000000000320000-0x0000000000338000-memory.dmp

Filesize
96KB

Download
memory/2732-5-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2732-6-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-7-0x00000000743AE000-0x00000000743AF000-memory.dmp

Filesize
4KB

Download
memory/2732-8-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download