b6769ecde3d67dcd2730639c5f20b0b71328184766621321dda7ea2b3da3d6e1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 03:39

Target

148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe
Size

30KB
MD5

148d0c0126fe163bf4a6f5499abc1a1b
SHA1

bb23fa18f530a94ec2cabf834c9292da25aadd72
SHA256

b6769ecde3d67dcd2730639c5f20b0b71328184766621321dda7ea2b3da3d6e1
SHA512

68e91a7839601f1a28f0e43d5d086a600ef4c568d97be6e82922364dc7e4be65aa9c238f4610fe0282e0ba5aa03fcf39d43391b71828d0d0435436314a7e9aff
SSDEEP

384:64aYvuNXApUNOLr0FzsM+tBtxaKk484IHHDUzRf/ZwanmletHSmJ:64aYvppU224IH0fxw8mQ9SmJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2916	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2916	148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3068	2916	148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3068	2916	148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3068	2916	148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3068	2916	148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\148d0c0126fe163bf4a6f5499abc1a1b_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 168
  2⤵
  - Program crash
  PID:3068