24f089cd7b8348eea7f18b3d69fe7bd4d000f1a4c2ba7889a5e133e9862cc1e2

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 15:43

Target

9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe
Size

612KB
MD5

9b3250409072ce5b4e4bc467f29102d2
SHA1

86a2fad69241a68a129c25531d5aea8ba2304bc3
SHA256

24f089cd7b8348eea7f18b3d69fe7bd4d000f1a4c2ba7889a5e133e9862cc1e2
SHA512

e7101b2f5d63410920d3b58e2c12ca00edba1351aa7d31cfa139af49f21f25fe328c0e446ee2885b046ca52083dfb012a6ea7555d86c098287dc1ff91d89b31f
SSDEEP

12288:RfEKhhYNpXXreuGFzpY2zkF9a37WSTUE8vcbI91BntKpzRrYBMKj:RcKMNpHqDJhLu35DzKJd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	1640	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2832	1640	9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe	28
PID 1640 wrote to memory of 2832	1640	9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe	28
PID 1640 wrote to memory of 2832	1640	9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe	28
PID 1640 wrote to memory of 2832	1640	9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 1516
  2⤵
  - Program crash
  PID:2832

memory/1640-0-0x0000000073EEE000-0x0000000073EEF000-memory.dmp

Filesize
4KB

Download
memory/1640-1-0x0000000000A60000-0x0000000000B02000-memory.dmp

Filesize
648KB

Download
memory/1640-2-0x00000000041A0000-0x000000000420A000-memory.dmp

Filesize
424KB

Download
memory/1640-3-0x0000000000230000-0x000000000024C000-memory.dmp

Filesize
112KB

Download
memory/1640-4-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/1640-5-0x0000000073EEE000-0x0000000073EEF000-memory.dmp

Filesize
4KB

Download
memory/1640-6-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download