6bae039ca693ec9d59c321f6edf4f498f903eb66827a018f94a576631819b7da

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 13:21

Target

fc6248a146e819bfe109067afde00b2e_JaffaCakes118.exe
Size

9KB
MD5

fc6248a146e819bfe109067afde00b2e
SHA1

7542523e4a619c3b57a1cb0be31aa604c9d79aac
SHA256

6bae039ca693ec9d59c321f6edf4f498f903eb66827a018f94a576631819b7da
SHA512

110f69d5dedf39ecf7c5528821ea32b474c03465c0136cb2090fb4540396f17f5ede77b2ad7dbfd83b6febe201ed8f59f350d6ab4cb7ff7a8937e62d7a651571
SSDEEP

192:GOhBksurzHNQ1leMZZ3L93VnjdwqzN3tzpK7nh:GvHKleM9Fnhwq5qn

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	fc6248a146e819bfe109067afde00b2e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2316	2528	fc6248a146e819bfe109067afde00b2e_JaffaCakes118.exe	31
PID 2528 wrote to memory of 2316	2528	fc6248a146e819bfe109067afde00b2e_JaffaCakes118.exe	31
PID 2528 wrote to memory of 2316	2528	fc6248a146e819bfe109067afde00b2e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\fc6248a146e819bfe109067afde00b2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc6248a146e819bfe109067afde00b2e_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2528 -s 888
  2⤵
  PID:2316

memory/2528-0-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/2528-2-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/2528-3-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/2528-4-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download