2bceadecd2a51b12ad331baa5eca05ccb11465eac937344392bebad797fdb1a5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 07:58

Target

0d4b00ac687d66b63651ef79d2775e43_JaffaCakes118.exe
Size

256KB
MD5

0d4b00ac687d66b63651ef79d2775e43
SHA1

942af0b938fbc5b7a7d19d03b788c188164cf350
SHA256

2bceadecd2a51b12ad331baa5eca05ccb11465eac937344392bebad797fdb1a5
SHA512

6675fa95f8c621fd828f7ae7fbce17dd2fd432206ca4c48dc8f8f3190631ad229564b40ed9a189bdb9fd6857bc7ab9ade561e5a7d0a79d7d218e9d0f11f9f048
SSDEEP

3072:+b/4Q/cwLIpUZ0A+en2EZTO+geMPBlQ9y9xRiiicKeEvxhvaOEhllsyQjAbAmcyH:JwRz2UtO+s+MRxicKNXvVEhjsyQ8kB

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	0d4b00ac687d66b63651ef79d2775e43_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2504	2440	0d4b00ac687d66b63651ef79d2775e43_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2504	2440	0d4b00ac687d66b63651ef79d2775e43_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2504	2440	0d4b00ac687d66b63651ef79d2775e43_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2504	2440	0d4b00ac687d66b63651ef79d2775e43_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0d4b00ac687d66b63651ef79d2775e43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d4b00ac687d66b63651ef79d2775e43_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  2⤵
  PID:2504

memory/2440-0-0x000007FEF5ADE000-0x000007FEF5ADF000-memory.dmp

Filesize
4KB

Download
memory/2440-1-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

Filesize
9.6MB

Download
memory/2440-2-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2440-3-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

Filesize
9.6MB

Download