cbdef2ecfbae812fb5e5c41392873f369bc3e8df8de6fe7e930969def3e17fec

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 08:25

Target

26c98101d0fa622211f642149f3fcd24_JaffaCakes118.exe
Size

460KB
MD5

26c98101d0fa622211f642149f3fcd24
SHA1

92c73cb569b2cd90f23e428ba313461dc99dbeb4
SHA256

cbdef2ecfbae812fb5e5c41392873f369bc3e8df8de6fe7e930969def3e17fec
SHA512

c7183677e39b0e72e6d6955223c1862689e2705d11d423e443ff70aae4b4ecc4de87b391b8c8c40370a29cdd5882a8cfd88e93549984767f6f9c89f46b3f290e
SSDEEP

6144:1z/ZOxjltwJvHPUya51ach20SdyjZUwQyvzxnzMl5Q9Yzovy5RuGGMAy:N6jltWE51BA0Rpfv8dovyb9

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4972	26c98101d0fa622211f642149f3fcd24_JaffaCakes118.exe
4972	26c98101d0fa622211f642149f3fcd24_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	4972	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\26c98101d0fa622211f642149f3fcd24_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26c98101d0fa622211f642149f3fcd24_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 140
  2⤵
  - Program crash
  PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4972 -ip 4972
1⤵
PID:2492

memory/4972-0-0x0000000000400000-0x00000000004DBB5B-memory.dmp

Filesize
878KB

Download
memory/4972-2-0x00000000004C5000-0x00000000004DC000-memory.dmp

Filesize
92KB

Download
memory/4972-1-0x00000000004C5000-0x00000000004DC000-memory.dmp

Filesize
92KB

Download
memory/4972-3-0x0000000000400000-0x00000000004DBB5B-memory.dmp

Filesize
878KB

Download