add6b1b042f2bd82c5815be2da1bf07218cbd2c06d918efab14dcca5476895d2

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 23:16

Target

4382aa929c17372af28b9dc4aa02eccd_JaffaCakes118.exe
Size

4.0MB
MD5

4382aa929c17372af28b9dc4aa02eccd
SHA1

3ee815b93e1720a7ce9533c4fd1f20bea32f036e
SHA256

add6b1b042f2bd82c5815be2da1bf07218cbd2c06d918efab14dcca5476895d2
SHA512

605a8c2113116e06b812ff0ceaf1e91b77640ea2ea5158ef6a0f32aa265684cb3acd752726e465b4a07646cdbbb00c956af534b0a3fb15c2bb9a65a7e9734177
SSDEEP

49152:rqI+NtPth0g2mlP/G20Zl11cxTXTw3ZTk0BA/lCFPQwEKVoiope+2M2/IICwe+b4:mIytPDRhAl7pBAtChEOHE

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1016	YShow.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
220	4382aa929c17372af28b9dc4aa02eccd_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	220	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1016	YShow.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1016	220	4382aa929c17372af28b9dc4aa02eccd_JaffaCakes118.exe	88
PID 220 wrote to memory of 1016	220	4382aa929c17372af28b9dc4aa02eccd_JaffaCakes118.exe	88
PID 220 wrote to memory of 1016	220	4382aa929c17372af28b9dc4aa02eccd_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\4382aa929c17372af28b9dc4aa02eccd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4382aa929c17372af28b9dc4aa02eccd_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 324
  2⤵
  - Program crash
  PID:4748
- C:\Users\Admin\AppData\Local\Temp\YShow.exe
  C:\Users\Admin\AppData\Local\Temp\\YShow.exe /i ÕÒ²»µ½Ö¸¶¨µÄ¼ÓÃÜËø£¡ /t ÌáÊ¾ÐÅÏ¢£º /k 16
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 220 -ip 220
1⤵
PID:2096

C:\Users\Admin\AppData\Local\Temp\YShow.exe

Filesize
24KB

MD5
0daeb0bb210da44dcd4fc2bb9c612719

SHA1
e33a519c28198eddeb24e346fd8aa2afb698a4e3

SHA256
13ac5ca5d3011a38061eab91ed53b295081d6ea21bbdcec8612b7862b72df975

SHA512
1d152f0a452bd945f93b536123b7ae7caa188f72dda424c2c42d2f432f4ec9f6972285821629dbff376e18f4025fc29a4f7c1f43a4771a386fb6939e65785672

Download Submit
memory/220-0-0x0000000000400000-0x0000000000808000-memory.dmp

Filesize
4.0MB

Download
memory/220-1-0x0000000000400000-0x0000000000813000-memory.dmp

Filesize
4.1MB

Download
memory/220-4-0x0000000000400000-0x0000000000813000-memory.dmp

Filesize
4.1MB

Download
memory/220-8-0x0000000000400000-0x0000000000813000-memory.dmp

Filesize
4.1MB

Download
memory/220-7-0x0000000000AA0000-0x0000000000AD7000-memory.dmp

Filesize
220KB

Download
memory/220-6-0x0000000000AA0000-0x0000000000AD7000-memory.dmp

Filesize
220KB

Download
memory/220-13-0x0000000000400000-0x0000000000813000-memory.dmp

Filesize
4.1MB

Download
memory/220-14-0x0000000000400000-0x0000000000808000-memory.dmp

Filesize
4.0MB

Download