0b6c18b95da972720ee7602f8b768305d55b5aa8cbfdad221b235ae6ed6ef9f3

Analysis

max time kernel
28s
max time network
39s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 23:28

Target

326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe
Size

1.8MB
MD5

326c8abfd32dad2f2fe5148a5727bfeb
SHA1

28a7aa29630337344e1b17d2f90f0c62ba903b69
SHA256

0b6c18b95da972720ee7602f8b768305d55b5aa8cbfdad221b235ae6ed6ef9f3
SHA512

0da9a94e805cd16ad865afa5f1eb3d3b69c656f132bc8925f2313327b50a4c6bd7e27eadf8b7c300bdaae3cc3ea57137c31136383a67fb15aeace942944d6948
SSDEEP

24576:swxEO+Lz2fh0k1iNQRXLYMPRhfbii+/dC7rhpjpOXNL2PVh6B+BzjmcP6:swaLWOk1K2YAo2DjpvBzjb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	560	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
560	326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
560	326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2720	560	326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe	29
PID 560 wrote to memory of 2720	560	326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe	29
PID 560 wrote to memory of 2720	560	326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe	29
PID 560 wrote to memory of 2720	560	326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\326c8abfd32dad2f2fe5148a5727bfeb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 1492
  2⤵
  - Program crash
  PID:2720

memory/560-0-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/560-1-0x0000000001240000-0x0000000001416000-memory.dmp

Filesize
1.8MB

Download
memory/560-2-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/560-5-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/560-4-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/560-3-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/560-6-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/560-7-0x0000000005BE0000-0x0000000005C90000-memory.dmp

Filesize
704KB

Download
memory/560-8-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/560-9-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/560-10-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/560-11-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/560-12-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/560-13-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download