16a4f7ff25e9274375bc625ea67f046d1a9c079822dea3a9946038be36254541

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 03:44

Target

f29cc8bfa8d0359349d6313e1fdaacbf_JaffaCakes118.exe
Size

458KB
MD5

f29cc8bfa8d0359349d6313e1fdaacbf
SHA1

9f9c4ee5b10664ff49396d618c096903b8d07d9a
SHA256

16a4f7ff25e9274375bc625ea67f046d1a9c079822dea3a9946038be36254541
SHA512

29dd576fb38805f0098a9edbc6d2bf9eb48124c00887c9041c990b7d7638a3f55a61d1e93b45051f078be75843f782efad420d92543828a2db306b4d93c610d8
SSDEEP

12288:zQnvPCScvTZjbu3SfzpGeHsc52bQ5Jzfv/dm48rCx:cnvX4TM3WpGNbkf3ATCx

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1832	f29cc8bfa8d0359349d6313e1fdaacbf_JaffaCakes118.exe
1832	f29cc8bfa8d0359349d6313e1fdaacbf_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3376	1832	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\f29cc8bfa8d0359349d6313e1fdaacbf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f29cc8bfa8d0359349d6313e1fdaacbf_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 140
  2⤵
  - Program crash
  PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1832 -ip 1832
1⤵
PID:4240

memory/1832-0-0x0000000000400000-0x00000000004DB881-memory.dmp

Filesize
878KB

Download
memory/1832-1-0x00000000004C5000-0x00000000004DC000-memory.dmp

Filesize
92KB

Download
memory/1832-2-0x00000000004C5000-0x00000000004DC000-memory.dmp

Filesize
92KB

Download
memory/1832-3-0x0000000000400000-0x00000000004DB881-memory.dmp

Filesize
878KB

Download