14b227d022eb752efd3a6dac77892f6ea5968bbf4386c8dce055b7a02a4860f4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 09:14

Target

04a283492d8fc3594ae0b4dd8810285e_JaffaCakes118.exe
Size

344KB
MD5

04a283492d8fc3594ae0b4dd8810285e
SHA1

7d7edc69a83f23bfd33e7715058b1b36d3a7e3e3
SHA256

14b227d022eb752efd3a6dac77892f6ea5968bbf4386c8dce055b7a02a4860f4
SHA512

debc8a679de90bf9e0b2e1434600787ed8f6ecfdc2019098313f8d45939466338ed75dabf516ec7f99b402c91b2b6fa1b1fe34a72415992f7896e1ce6b9d71a7
SSDEEP

6144:y23ojMmKuEHgFdsbWy6G0+9jkjdtVyqEdi4tWOiuSbzTPD3xS:y23ojMmKuEHgdn3EE4qlySbzT73xS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1432	3008	04a283492d8fc3594ae0b4dd8810285e_JaffaCakes118.exe	28
PID 3008 wrote to memory of 1432	3008	04a283492d8fc3594ae0b4dd8810285e_JaffaCakes118.exe	28
PID 3008 wrote to memory of 1432	3008	04a283492d8fc3594ae0b4dd8810285e_JaffaCakes118.exe	28
PID 3008 wrote to memory of 1432	3008	04a283492d8fc3594ae0b4dd8810285e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\04a283492d8fc3594ae0b4dd8810285e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04a283492d8fc3594ae0b4dd8810285e_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 568
  2⤵
  PID:1432

memory/1432-4-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/3008-0-0x00000000744E1000-0x00000000744E2000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/3008-2-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/3008-3-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/3008-5-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download