52a8ab87702bbceef6929747ed89a5c884bceea8ec73bdd357130e2661c2bf75

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 07:07

Target

3e77d0a932f823db81bf554bc7c1ed50_JaffaCakes118.exe
Size

9KB
MD5

3e77d0a932f823db81bf554bc7c1ed50
SHA1

f77d757b38e81c8bd88714ff74300f63148edfa5
SHA256

52a8ab87702bbceef6929747ed89a5c884bceea8ec73bdd357130e2661c2bf75
SHA512

90e1a352b2dec005d83242f91f2d791a179edf7d933da3aca34ba0f302029c91b2600ac9a9d0832fee59408f3cccddbc43b727c2cc681f38a1166c5648dd7836
SSDEEP

192:4BksuXPY82gQv5F4UtQ3eMZZ3793VnjdwCzG3tdt7:082l4UtqeM9FnhwCi9dt

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	3e77d0a932f823db81bf554bc7c1ed50_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2840	1812	3e77d0a932f823db81bf554bc7c1ed50_JaffaCakes118.exe	30
PID 1812 wrote to memory of 2840	1812	3e77d0a932f823db81bf554bc7c1ed50_JaffaCakes118.exe	30
PID 1812 wrote to memory of 2840	1812	3e77d0a932f823db81bf554bc7c1ed50_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3e77d0a932f823db81bf554bc7c1ed50_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e77d0a932f823db81bf554bc7c1ed50_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1812 -s 892
  2⤵
  PID:2840

memory/1812-0-0x000007FEF5B33000-0x000007FEF5B34000-memory.dmp

Filesize
4KB

Download
memory/1812-1-0x0000000000130000-0x0000000000138000-memory.dmp

Filesize
32KB

Download
memory/1812-2-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-3-0x000007FEF5B33000-0x000007FEF5B34000-memory.dmp

Filesize
4KB

Download
memory/1812-4-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-5-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download