48f6f4c9a2bc44617ccd95e7362b1fcfd75b3fed8162d28727c7f0da2edc0300

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 09:34

Target

3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe
Size

87KB
MD5

3cd7c86af5fe368c3add0b9d55034060
SHA1

b1f33ced39f0acb09486651e92a2cb8cda0543d4
SHA256

48f6f4c9a2bc44617ccd95e7362b1fcfd75b3fed8162d28727c7f0da2edc0300
SHA512

a46cd7ce505dbce2ac2e75956861c826065d0be682036e370b4d93afd1ffd48eef3b67432d1cbc2084b68ff82bd6bf3d2273e13bb96e7840dd7a2e501283c273
SSDEEP

1536:Kvm14+EEZdVvF59CwWs2BsUUPvYXNd1UDIE3FwR+X9:HtHZHL9JWeUUPvYXH1UDIE3/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1880	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe
1880	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2076	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	30
PID 900 wrote to memory of 2076	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	30
PID 900 wrote to memory of 2076	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	30
PID 900 wrote to memory of 2076	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	30
PID 900 wrote to memory of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31
PID 900 wrote to memory of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31
PID 900 wrote to memory of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31
PID 900 wrote to memory of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31
PID 900 wrote to memory of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31
PID 900 wrote to memory of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31
PID 900 wrote to memory of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31
PID 900 wrote to memory of 1880	900	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	31
PID 1880 wrote to memory of 1136	1880	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	20
PID 1880 wrote to memory of 1136	1880	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	20
PID 1880 wrote to memory of 1136	1880	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	20
PID 1880 wrote to memory of 1136	1880	3cd7c86af5fe368c3add0b9d55034060_JaffaCakes118.exe	20

memory/900-11-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/900-2-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/900-1-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/900-0-0x00000000741C1000-0x00000000741C2000-memory.dmp

Filesize
4KB

Download
memory/1136-16-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1136-12-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1880-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1880-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1880-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1880-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1880-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1880-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1880-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download