6536cbc5aad2bd6eee29bde00129556129ca02430b68bf657d6f74e4bcf7739e

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 04:51

Target

02f2032eddadae5003803f1ebeb1b1c0_JaffaCakes118.exe
Size

125KB
MD5

02f2032eddadae5003803f1ebeb1b1c0
SHA1

04e8c27f06fc28384b92ac4e4501a31f9b1bc345
SHA256

6536cbc5aad2bd6eee29bde00129556129ca02430b68bf657d6f74e4bcf7739e
SHA512

5923dc6c06761ce23e855690304cd20057bf31d58bd6999d0c5aeeb4258f67a3d698abc713512db730cba76154e1ac9b9d8668ca03e1c950ad3f810897339b73
SSDEEP

3072:3143an9dsF5mp3V//hcHj5sDc6fFbMfM0gECj52vDcT:i89vd/huj5EFYE9ECjI4T

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4268	1588	WerFault.exe	91
2744	1588	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4268	1588	02f2032eddadae5003803f1ebeb1b1c0_JaffaCakes118.exe	94
PID 1588 wrote to memory of 4268	1588	02f2032eddadae5003803f1ebeb1b1c0_JaffaCakes118.exe	94
PID 1588 wrote to memory of 4268	1588	02f2032eddadae5003803f1ebeb1b1c0_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\02f2032eddadae5003803f1ebeb1b1c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f2032eddadae5003803f1ebeb1b1c0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 224
  2⤵
  - Program crash
  PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 224
  2⤵
  - Program crash
  PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 1588 -ip 1588
1⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1860