fd4da713f5fa1039c38f24a0865cfc3dc4f05c9e9ccc637888b94d1cbfebd54d

Analysis

max time kernel
139s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 20:34

Target

1c6803eeafbff433c4100098e69e592d_JaffaCakes118.exe
Size

51KB
MD5

1c6803eeafbff433c4100098e69e592d
SHA1

011f76bda7a1ba918b518245d2c3d9a2c28594f4
SHA256

fd4da713f5fa1039c38f24a0865cfc3dc4f05c9e9ccc637888b94d1cbfebd54d
SHA512

1440b047d81b0bc6bc9e5ffc76e6f3d98ec05cc5b21a4cbebbbc16fef768a99eb331b43da34148dd66b4568443f49df9cd61f08e8246f4ce71be35660564df31
SSDEEP

768:isDWJP/oYHz0geE0CtAixFsaF2GteE2Vvb:isD2P9BeBCqoFsaFZ0E2x

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4128	652	WerFault.exe	89
2140	652	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 4128	652	1c6803eeafbff433c4100098e69e592d_JaffaCakes118.exe	92
PID 652 wrote to memory of 4128	652	1c6803eeafbff433c4100098e69e592d_JaffaCakes118.exe	92
PID 652 wrote to memory of 4128	652	1c6803eeafbff433c4100098e69e592d_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\1c6803eeafbff433c4100098e69e592d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c6803eeafbff433c4100098e69e592d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 224
  2⤵
  - Program crash
  PID:4128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 224
  2⤵
  - Program crash
  PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 652 -ip 652
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:1680

memory/652-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/652-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download