1eb52597ea1bd3206b81cb784cc41f84dd5235cfb4bb9b556031710170f2fa21

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 06:11

Target

27828339c7f7fc57a8e53d44383c1e90_JaffaCakes118.exe
Size

424KB
MD5

27828339c7f7fc57a8e53d44383c1e90
SHA1

1a881f8cc3ecbbf65d0723a47b2494f8f0446ebb
SHA256

1eb52597ea1bd3206b81cb784cc41f84dd5235cfb4bb9b556031710170f2fa21
SHA512

92ae2e62c509bc5c4b40e984c9298f20ae6d3aa43b3831b38170c2e990fede00a8bcbc18064097d70c6d7b5a94fd734bb441894b56334732f300ed339b01458d
SSDEEP

12288:bvPfQ2Miwo01Yqg81DZWQl10RuLCqJY2Rye:rXQ1lH32RMCy0e

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1724	2248	27828339c7f7fc57a8e53d44383c1e90_JaffaCakes118.exe	28
PID 2248 wrote to memory of 1724	2248	27828339c7f7fc57a8e53d44383c1e90_JaffaCakes118.exe	28
PID 2248 wrote to memory of 1724	2248	27828339c7f7fc57a8e53d44383c1e90_JaffaCakes118.exe	28
PID 2248 wrote to memory of 1724	2248	27828339c7f7fc57a8e53d44383c1e90_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\27828339c7f7fc57a8e53d44383c1e90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27828339c7f7fc57a8e53d44383c1e90_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 588
  2⤵
  PID:1724

memory/1724-4-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1724-6-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2248-0-0x00000000747F1000-0x00000000747F2000-memory.dmp

Filesize
4KB

Download
memory/2248-1-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2248-3-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2248-2-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2248-5-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download