f2b33071fdb0e3a7f6fb85af63591672d08f4b0929aa7d7f969920e3f8fa0d7d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 09:16

Target

19968d10518aa53a735d97e55759107d_JaffaCakes118.exe
Size

46KB
MD5

19968d10518aa53a735d97e55759107d
SHA1

53fce0a889ae4c8991c2c04b6e48768664255e2b
SHA256

f2b33071fdb0e3a7f6fb85af63591672d08f4b0929aa7d7f969920e3f8fa0d7d
SHA512

42093482f1b6e35506b1ee29381554f2a3bd0fe21ea188da9d80ab9784c5d8d9060ea32d548b234cb0dda116d20654da0a5f7f113bdf9fcd2de52221162b7bf3
SSDEEP

768:UJ4JnmaSEDbLhcyVp8ENL0YsUbPiI0PfNcojyjcKUAr6K0HOL3fj40x1tvg2bzYR:q0DbL3VVou/0n+oj67Ue6Hurfj403to5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	19968d10518aa53a735d97e55759107d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3932	2012	19968d10518aa53a735d97e55759107d_JaffaCakes118.exe	83
PID 2012 wrote to memory of 3932	2012	19968d10518aa53a735d97e55759107d_JaffaCakes118.exe	83
PID 2012 wrote to memory of 4064	2012	19968d10518aa53a735d97e55759107d_JaffaCakes118.exe	84
PID 2012 wrote to memory of 4064	2012	19968d10518aa53a735d97e55759107d_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\19968d10518aa53a735d97e55759107d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19968d10518aa53a735d97e55759107d_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\19968d10518aa53a735d97e55759107d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\19968d10518aa53a735d97e55759107d_JaffaCakes118.exe
  2⤵
  PID:3932
- C:\Users\Admin\AppData\Local\Temp\19968d10518aa53a735d97e55759107d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\19968d10518aa53a735d97e55759107d_JaffaCakes118.exe
  2⤵
  PID:4064

memory/2012-0-0x00007FFCABCD5000-0x00007FFCABCD6000-memory.dmp

Filesize
4KB

Download
memory/2012-1-0x000000001B260000-0x000000001B306000-memory.dmp

Filesize
664KB

Download
memory/2012-2-0x00007FFCABA20000-0x00007FFCAC3C1000-memory.dmp

Filesize
9.6MB

Download
memory/2012-4-0x00007FFCABA20000-0x00007FFCAC3C1000-memory.dmp

Filesize
9.6MB

Download
memory/2012-5-0x00007FFCABA20000-0x00007FFCAC3C1000-memory.dmp

Filesize
9.6MB

Download