a2254dea4dddd0f80060116e7d85648fc344e401a0ae9891d453d829b7967a9f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/11/2024, 05:08

Target

b4eb318067d023712e4a65b2428795b4_JaffaCakes118.exe
Size

9KB
MD5

b4eb318067d023712e4a65b2428795b4
SHA1

c0f5ef2c58ecf437274e2bd4ae175ff3a7ed40f7
SHA256

a2254dea4dddd0f80060116e7d85648fc344e401a0ae9891d453d829b7967a9f
SHA512

4e1a5343317d18001f9a1f8016a099bacd0833684c5a9cf716578d899410d0fbce1431ba07b6db56bdb3b8a2da8d2318261b070b710774087396cbaf5d9c7952
SSDEEP

192:tBksubPY82gQv5F4rtleMZZ3a93VnjdwCzo38Uz9TX:L82l4rtleM+FnhwCEME9T

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	b4eb318067d023712e4a65b2428795b4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 840	1448	b4eb318067d023712e4a65b2428795b4_JaffaCakes118.exe	30
PID 1448 wrote to memory of 840	1448	b4eb318067d023712e4a65b2428795b4_JaffaCakes118.exe	30
PID 1448 wrote to memory of 840	1448	b4eb318067d023712e4a65b2428795b4_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\b4eb318067d023712e4a65b2428795b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4eb318067d023712e4a65b2428795b4_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1448 -s 892
  2⤵
  PID:840

memory/1448-0-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

Filesize
4KB

Download
memory/1448-1-0x0000000001180000-0x0000000001188000-memory.dmp

Filesize
32KB

Download
memory/1448-2-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/1448-3-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

Filesize
4KB

Download
memory/1448-4-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/1448-5-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download