905c3968a3196073d89b3f296162069cc9c8b069839d4ececae7a2a943da272e

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 02:01

Target

37e92efc202209ad3bfc4366ee8eac13_JaffaCakes118.exe
Size

9KB
MD5

37e92efc202209ad3bfc4366ee8eac13
SHA1

2da4b89a399faa3544a08b75f3c389501784b494
SHA256

905c3968a3196073d89b3f296162069cc9c8b069839d4ececae7a2a943da272e
SHA512

e3a8c8a6e28d3429f0437c69a1686f74bc608986420b44537de483d3f626e7d3b60bf2c07619eaa93bb9833204c1b998d24d5d798c62b870fd9153acf7d6a071
SSDEEP

192:sBksurEXVwVt7eMZZ3I93VnjdwCzW3aqUzW7:YVw37eMsFnhwCK6W

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	37e92efc202209ad3bfc4366ee8eac13_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2576	2776	37e92efc202209ad3bfc4366ee8eac13_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2576	2776	37e92efc202209ad3bfc4366ee8eac13_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2576	2776	37e92efc202209ad3bfc4366ee8eac13_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\37e92efc202209ad3bfc4366ee8eac13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37e92efc202209ad3bfc4366ee8eac13_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2776 -s 892
  2⤵
  PID:2576

memory/2776-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2776-1-0x00000000011D0000-0x00000000011D8000-memory.dmp

Filesize
32KB

Download
memory/2776-2-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-3-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2776-4-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-5-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download