b890bd371ac6cde8edda3be38181510465caddda53be7ad9f26ff3a93d25c08e

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 09:14

Target

2804409811528795faa1108b66bc454e_JaffaCakes118.exe
Size

120KB
MD5

2804409811528795faa1108b66bc454e
SHA1

fa1b4e5ad06b9d143f571afbb24f56cce4407152
SHA256

b890bd371ac6cde8edda3be38181510465caddda53be7ad9f26ff3a93d25c08e
SHA512

64ffe43d69b26e35a328f7e01b87ca795e0fad335346b9adb21df7d683acc4c38e0ceb35f36fbc4110a5f6f73b823f4e7c5a790b51a881883f79099360ccaf75
SSDEEP

1536:Asqss/kkOCuum9hjDOwFvHKlYJ3TA0sa3y19NtE2ZlpJKBCwhT:APaNCuNhjDOoylY1cJa3E82ZRKn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	1752	WerFault.exe	28

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1752	2804409811528795faa1108b66bc454e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1752	2804409811528795faa1108b66bc454e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3032	1752	2804409811528795faa1108b66bc454e_JaffaCakes118.exe	29
PID 1752 wrote to memory of 3032	1752	2804409811528795faa1108b66bc454e_JaffaCakes118.exe	29
PID 1752 wrote to memory of 3032	1752	2804409811528795faa1108b66bc454e_JaffaCakes118.exe	29
PID 1752 wrote to memory of 3032	1752	2804409811528795faa1108b66bc454e_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2804409811528795faa1108b66bc454e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2804409811528795faa1108b66bc454e_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 288
  2⤵
  - Program crash
  PID:3032

memory/1752-4-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1752-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1752-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1752-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1752-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1752-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download