722ce43c015173159b8ba42806e9e18563a17319e78d3b4e7da1868bbb2c7ceb

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 19:48

Target

4b242e9c702dd09205545dbc61296ab3_JaffaCakes118.exe
Size

402KB
MD5

4b242e9c702dd09205545dbc61296ab3
SHA1

78e2bd146621e003d421f370f3503778d4fb7dc1
SHA256

722ce43c015173159b8ba42806e9e18563a17319e78d3b4e7da1868bbb2c7ceb
SHA512

bbe55d0b467fbaf41b6bbf5be5bd4424ea6ee2c444b61f5d663d87e7832a6fc3ebefb55d0faf37e7c0ce5fd03b2557b7c7a3f9f18821ec5b40822c202bdd78fe
SSDEEP

6144:/bLzD+I1nhjenoKH7xKupfYsancZSTVNr7nhhEbp0d2CgzDiPKiqYP7sAxq0:TLzrqPHvuVJphhEbpz2tqYP7sAH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1104	4b242e9c702dd09205545dbc61296ab3_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2720	1104	WerFault.exe	82
1988	1104	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\4b242e9c702dd09205545dbc61296ab3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b242e9c702dd09205545dbc61296ab3_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 220
  2⤵
  - Program crash
  PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 152
  2⤵
  - Program crash
  PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1104 -ip 1104
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1104 -ip 1104
1⤵
PID:400