6cb1c746628484099a7f7e00299fbf1637944d855433b5d800d107a9da78c42e

Analysis

max time kernel
140s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 08:54

Target

27f75febea1844854a635af3703e73ff_JaffaCakes118.exe
Size

215KB
MD5

27f75febea1844854a635af3703e73ff
SHA1

b3c298b12b1f96392169591181901014f797e4ac
SHA256

6cb1c746628484099a7f7e00299fbf1637944d855433b5d800d107a9da78c42e
SHA512

03932ea5b724f1d1ab9ca626d03f9b9abc31e6d51d5831f48ff7a53b915321e0231728c2d8dcacb0ad9d888d2d82d8f6d7fb3be355237d195ae70462ba0dc14c
SSDEEP

3072:UQg+9yh2Y6dA8nQdNnGxjyMzjAgQHBstT7c4Xl46kblN7E+OOdGoKg9AvHM0Xym2:UQgIC0RQFgAgCFZ68lZE+IhvHs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	2864	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2864	27f75febea1844854a635af3703e73ff_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	27f75febea1844854a635af3703e73ff_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 1544	2864	27f75febea1844854a635af3703e73ff_JaffaCakes118.exe	30
PID 2864 wrote to memory of 1544	2864	27f75febea1844854a635af3703e73ff_JaffaCakes118.exe	30
PID 2864 wrote to memory of 1544	2864	27f75febea1844854a635af3703e73ff_JaffaCakes118.exe	30
PID 2864 wrote to memory of 1544	2864	27f75febea1844854a635af3703e73ff_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\27f75febea1844854a635af3703e73ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27f75febea1844854a635af3703e73ff_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 232
  2⤵
  - Program crash
  PID:1544

memory/2864-0-0x0000000000400000-0x000000000043FC00-memory.dmp

Filesize
255KB

Download