2a60a09a98582eb4475d2a89df454b7a5bcc964f1a5551d781c2da195bed490a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 19:35

Target

b4d8d803b377147dc45be9abe91c43b5_JaffaCakes118.exe
Size

871KB
MD5

b4d8d803b377147dc45be9abe91c43b5
SHA1

3af30230d9699af42482ddf6b1892eda759daf25
SHA256

2a60a09a98582eb4475d2a89df454b7a5bcc964f1a5551d781c2da195bed490a
SHA512

ad8120d3443b878b244e0c6f0d7ff49c63b38f9752836f18744e55f0ff1fc5c06aec373bf41c6cb80be65fb9f1169be927ba0d3303a88443243152546962e3b4
SSDEEP

12288:bmczcYLIe+xs8Ygwy7shvYv2zv1gwbPive/j/ApPZMnsfBRZZhFCePc0xVfXG3Jb:btcYd988xD2wbPt+f/DCz0BIzMQw1xH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

860 3376 WerFault.exe b4d8d803b377147dc45be9abe91c43b5_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b4d8d803b377147dc45be9abe91c43b5_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3376 b4d8d803b377147dc45be9abe91c43b5_JaffaCakes118.exe

pid	pid_target	process	target process
860	3376	WerFault.exe	b4d8d803b377147dc45be9abe91c43b5_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3376	b4d8d803b377147dc45be9abe91c43b5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b4d8d803b377147dc45be9abe91c43b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4d8d803b377147dc45be9abe91c43b5_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 1340
2⤵
- Program crash
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3376 -ip 3376
1⤵
PID:4132

memory/3376-0-0x000000007509E000-0x000000007509F000-memory.dmp

Filesize
4KB

Download
memory/3376-1-0x00000000001B0000-0x0000000000294000-memory.dmp

Filesize
912KB

Download