08567099c980b6b7e9370ea51eb5567a85bf0d5bd1a97eeb4167fdaafe6c9f2e

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:54

Target

3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe
Size

397KB
MD5

3932bfc7da25869a56bb6b403d965394
SHA1

2db6a0a4bc93015ff4b796e953ae546ed8dc1e26
SHA256

08567099c980b6b7e9370ea51eb5567a85bf0d5bd1a97eeb4167fdaafe6c9f2e
SHA512

0766f0423257fa5b6244720578a947f21eb50d92c995de161150d4d5fb4032a3b82c129460f470e26199417e52c39804d39d199e640acd46691bb04401efcb41
SSDEEP

3072:4eFXs/QHelmNHaduN2czYt4YiYdAx+9C+Op4Xvce00DBt88bKy3eFXs/QHelmNnc:XX+zmNHadn4yJ/cRX+zmNnadn4yJ/c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2364	3048	3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2364	3048	3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2364	3048	3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 476
  2⤵
  PID:2364

memory/2364-2-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/3048-0-0x000007FEF507E000-0x000007FEF507F000-memory.dmp

Filesize
4KB

Download
memory/3048-1-0x000007FEF4DC0000-0x000007FEF575D000-memory.dmp

Filesize
9.6MB

Download
memory/3048-3-0x000007FEF4DC0000-0x000007FEF575D000-memory.dmp

Filesize
9.6MB

Download