c06aa0e4fb0262f3b7546041a80609ae9a1b043231b5914fbd220fcdb8dd3916

Analysis

max time kernel
95s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 21:36

Target

3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe
Size

53KB
MD5

3acce176d892e348ff94e2e09f7655de
SHA1

fe616545461aa1cc5ad7b32cc42a5bda0afd86f4
SHA256

c06aa0e4fb0262f3b7546041a80609ae9a1b043231b5914fbd220fcdb8dd3916
SHA512

88f849042dcdbb6df4bc89fc9e59d04295c0775d2eb708a737b6111841c3742021c4574331754ffadf685cabb5ea695f7f7bf08e3276f47051098e46e24cbef2
SSDEEP

1536:a5/AqeWVJ4N1vGVpPxwZ7T8KYUjLu0qC+:aZAqeSJ41CCdTOcLuI+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 1200	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1200	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe
1200	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe
1200	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe
1200	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1200	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	84
PID 2416 wrote to memory of 1200	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	84
PID 2416 wrote to memory of 1200	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	84
PID 2416 wrote to memory of 1200	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	84
PID 2416 wrote to memory of 1200	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	84
PID 2416 wrote to memory of 1200	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	84
PID 2416 wrote to memory of 1200	2416	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	84
PID 1200 wrote to memory of 3564	1200	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	56
PID 1200 wrote to memory of 3564	1200	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	56
PID 1200 wrote to memory of 3564	1200	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	56
PID 1200 wrote to memory of 3564	1200	3acce176d892e348ff94e2e09f7655de_JaffaCakes118.exe	56

memory/1200-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1200-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1200-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1200-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1200-14-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2416-0-0x0000000074D02000-0x0000000074D03000-memory.dmp

Filesize
4KB

Download
memory/2416-1-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/2416-2-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/2416-8-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/3564-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3564-11-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download