b1352606d4aa5902b9284b1d03cdab3c03caceaa170c0dc8afd99e0ffe81e7c5

Analysis

max time kernel
92s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 02:50

Target

2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe
Size

639KB
MD5

2ab9c94338607b9908c7fa0a8e359545
SHA1

b21c53d47b9b219997f57d79f2343dc69a0d92ca
SHA256

b1352606d4aa5902b9284b1d03cdab3c03caceaa170c0dc8afd99e0ffe81e7c5
SHA512

a3c717bf231ae35277694764577af954bfb7428b0fe99f07028af61f467c5eb414ad45f61ef0318c53222a3a1eda3d522c8bead9ff8361b669b259bd18b51dcd
SSDEEP

12288:YCNO0VNmHzHV2aPHhUoS92Qj7tjbc+WmWtgk0Tv5ToZlTTHaUVRtr9:/Nvqzb5ajxjpWjGTuPr

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1500	4932	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	85
PID 4932 wrote to memory of 1500	4932	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe
  2⤵
  PID:1500

memory/4932-0-0x00007FFC18025000-0x00007FFC18026000-memory.dmp

Filesize
4KB

Download
memory/4932-1-0x00007FFC17D70000-0x00007FFC18711000-memory.dmp

Filesize
9.6MB

Download
memory/4932-2-0x000000001B970000-0x000000001BA16000-memory.dmp

Filesize
664KB

Download
memory/4932-3-0x00007FFC17D70000-0x00007FFC18711000-memory.dmp

Filesize
9.6MB

Download
memory/4932-4-0x0000000000DD0000-0x0000000000DEA000-memory.dmp

Filesize
104KB

Download
memory/4932-5-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

Filesize
64KB

Download
memory/4932-6-0x000000001BA80000-0x000000001BADE000-memory.dmp

Filesize
376KB

Download
memory/4932-7-0x000000001C410000-0x000000001C8DE000-memory.dmp

Filesize
4.8MB

Download
memory/4932-8-0x000000001C8E0000-0x000000001C97C000-memory.dmp

Filesize
624KB

Download
memory/4932-9-0x00000000010C0000-0x00000000010C8000-memory.dmp

Filesize
32KB

Download
memory/4932-10-0x000000001C9F0000-0x000000001CA3C000-memory.dmp

Filesize
304KB

Download
memory/4932-11-0x00007FFC17D70000-0x00007FFC18711000-memory.dmp

Filesize
9.6MB

Download
memory/4932-13-0x00007FFC17D70000-0x00007FFC18711000-memory.dmp

Filesize
9.6MB

Download