8d8c759830365b63fa35a48f511fc186e1fe7952f00fd92c0c1867843b920318

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 16:48

Target

313047f0bee2de9b25e8f30398486288_JaffaCakes118.exe
Size

425KB
MD5

313047f0bee2de9b25e8f30398486288
SHA1

0910c14c624eb0cdcf7d0def59bccd5cad08f539
SHA256

8d8c759830365b63fa35a48f511fc186e1fe7952f00fd92c0c1867843b920318
SHA512

be9eba441b778b3524fd834e0b20b080478eccc60592324ee4bdb83eb699d4cdac767b87a630cc47506dd105bb34bdf54b147de00c1e9fc8058bd9a3bf58c8fa
SSDEEP

6144:eklMjWY6fOlnODeRI3248dUzmk5kxU94xi61Ras59PAdNyj8vWqQ5Rp9WqBft:ek2sW8qONvzX5kxebfywvW/VrBft

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4504	313047f0bee2de9b25e8f30398486288_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1600	4504	WerFault.exe	80
4316	4504	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\313047f0bee2de9b25e8f30398486288_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\313047f0bee2de9b25e8f30398486288_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 196
  2⤵
  - Program crash
  PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 140
  2⤵
  - Program crash
  PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4504 -ip 4504
1⤵
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4504 -ip 4504
1⤵
PID:4232