c06aa0e4fb0262f3b7546041a80609ae9a1b043231b5914fbd220fcdb8dd3916

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 21:36

Target

3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe
Size

53KB
MD5

3acce176d892e348ff94e2e09f7655de
SHA1

fe616545461aa1cc5ad7b32cc42a5bda0afd86f4
SHA256

c06aa0e4fb0262f3b7546041a80609ae9a1b043231b5914fbd220fcdb8dd3916
SHA512

88f849042dcdbb6df4bc89fc9e59d04295c0775d2eb708a737b6111841c3742021c4574331754ffadf685cabb5ea695f7f7bf08e3276f47051098e46e24cbef2
SSDEEP

1536:a5/AqeWVJ4N1vGVpPxwZ7T8KYUjLu0qC+:aZAqeSJ41CCdTOcLuI+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2952	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe
2952	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29
PID 1944 wrote to memory of 2952	1944	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	29
PID 2952 wrote to memory of 1384	2952	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	20
PID 2952 wrote to memory of 1384	2952	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	20
PID 2952 wrote to memory of 1384	2952	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	20
PID 2952 wrote to memory of 1384	2952	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	20

memory/1384-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1384-12-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1944-0-0x00000000748B1000-0x00000000748B2000-memory.dmp

Filesize
4KB

Download
memory/1944-1-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1944-2-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1944-6-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2952-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2952-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2952-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2952-8-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2952-21-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download