911016f312442e5ca2f75503f7e1cba345b12bf129cadda27e4ebc76fe985c7b

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:06

Target

638e985f20fe846c857a76dad0917b5f_JaffaCakes118.exe
Size

98KB
MD5

638e985f20fe846c857a76dad0917b5f
SHA1

683de5a44c6bfeb12f0c84e97eef706ce0f7620c
SHA256

911016f312442e5ca2f75503f7e1cba345b12bf129cadda27e4ebc76fe985c7b
SHA512

e513d52c2605845fdfa2d56a5b22f7d4c77a0ee336b5f8a231a23653bea1e794b8fcdd1a12cd7701ffa677b426a6ef7aa6e7d9b3f71dadea65dfd2dd4ac8dfea
SSDEEP

3072:SlCqMhhX96rjrBIefj8z8++AWhj5aTbEy40:rT96H1Ji05040

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4192	4764	WerFault.exe	638e985f20fe846c857a76dad0917b5f_JaffaCakes118.exe
4560	4764	WerFault.exe	638e985f20fe846c857a76dad0917b5f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

638e985f20fe846c857a76dad0917b5f_JaffaCakes118.exe

pid process

4764 638e985f20fe846c857a76dad0917b5f_JaffaCakes118.exe

pid	process
4764	638e985f20fe846c857a76dad0917b5f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\638e985f20fe846c857a76dad0917b5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\638e985f20fe846c857a76dad0917b5f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 432
  2⤵
  - Program crash
  PID:4192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 456
  2⤵
  - Program crash
  PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4764 -ip 4764
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4764 -ip 4764
1⤵
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:404