dee76d2bf51b12f184f084cef08841a7cf934928b0bfcc69d7a6dc0f88bff30e

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 19:45

Target

ee4ce5083e7e5aae98bcafca7b133640_JaffaCakes118.exe
Size

36KB
MD5

ee4ce5083e7e5aae98bcafca7b133640
SHA1

1bc0eb701d4248fb3c7a15146c0aaece2c003a47
SHA256

dee76d2bf51b12f184f084cef08841a7cf934928b0bfcc69d7a6dc0f88bff30e
SHA512

6f3e86fc554609130f3eb2fd4ac814f6f0e895f33bd58ee7d10b8671baacc3bb7667910b6315e83a1b0efb538245f04c6f945c71a5d8a21f65ac2adb23de8ae8
SSDEEP

768:u7HEvxj+TPYFTOqdR5V5sj7ILksH0Gnb6XnlmWsOL:u7Ew2Xl3R5n+lKOL

Score

10^/10

Credentials

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
388	ee4ce5083e7e5aae98bcafca7b133640_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	ee4ce5083e7e5aae98bcafca7b133640_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 1920	388	ee4ce5083e7e5aae98bcafca7b133640_JaffaCakes118.exe	31
PID 388 wrote to memory of 1920	388	ee4ce5083e7e5aae98bcafca7b133640_JaffaCakes118.exe	31
PID 388 wrote to memory of 1920	388	ee4ce5083e7e5aae98bcafca7b133640_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\ee4ce5083e7e5aae98bcafca7b133640_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee4ce5083e7e5aae98bcafca7b133640_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 388 -s 1296
  2⤵
  PID:1920

memory/388-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download
memory/388-1-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/388-2-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/388-3-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/388-4-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download
memory/388-5-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/388-6-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download