42bdcf32d5dc255904025f1f025760bdb0f6c6d0dfcb4226eaca9d690b8db62a

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:09

Target

696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe
Size

391KB
MD5

696714abf3989e5291d2fd8f1845a756
SHA1

220b728deefa4d9dd56235c33045c48384e0ef4d
SHA256

42bdcf32d5dc255904025f1f025760bdb0f6c6d0dfcb4226eaca9d690b8db62a
SHA512

bfb0cb7260228dc4d53ef4b95e1bf9cf9ffe2a0bb8766d30f000ec1c255ee8bd0c66708d19397f7b4b0868de9784076d10dcae3f9b477a2224124163aa3ce4db
SSDEEP

12288:sHQjY2RDh62hvCfphW2AoG61ko3YBpA8M:sHQjRRDh62hf2Af6SoIBpr

Score

7^/10

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2376	4752	WerFault.exe	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe
2528	4752	WerFault.exe	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe
2908	4752	WerFault.exe	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe
1860	4752	WerFault.exe	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe"
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 740
2⤵
- Program crash
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 744
2⤵
- Program crash
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 752
2⤵
- Program crash
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 440
2⤵
- Program crash
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4752 -ip 4752
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4752 -ip 4752
1⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4752 -ip 4752
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4752 -ip 4752
1⤵
PID:4604

memory/4752-1-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/4752-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-3-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-7-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-9-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/4752-10-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-13-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-16-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-17-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4752-18-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download