965dc129546c57590fa4d26dca389217095a9c7193f7e31064dcad3d13cb177c

Analysis

max time kernel
10s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 11:20

Target

965dc129546c57590fa4d26dca389217095a9c7193f7e31064dcad3d13cb177c.pdf
Size

24KB
MD5

716d1df40f2d93802df98ad48749228b
SHA1

9fd184961898eaa81599c38710896a1f698149d0
SHA256

965dc129546c57590fa4d26dca389217095a9c7193f7e31064dcad3d13cb177c
SHA512

c38337ea63bf5ddd1d75004533fb511645a8c30bab5a19caaa39d739dcb57ca70cbb33262a31a0d5cd3d90ce812e58fb55d5fe94bc0b69ebfd404dc30c65675c
SSDEEP

768:er+qWmp88duZvZLqGkjsrdZyYygns4FKZzBvmpAJ0wSUBDl3x:RUUdnt8Zz9m+JdSqh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 880 WerFault.exe AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

880 AcroRd32.exe
880 AcroRd32.exe
880 AcroRd32.exe

pid	pid_target	process	target process
2008	880	WerFault.exe	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

AcroRd32.exe

description	pid	process	target process
PID 880 wrote to memory of 2008	880	AcroRd32.exe	WerFault.exe
PID 880 wrote to memory of 2008	880	AcroRd32.exe	WerFault.exe
PID 880 wrote to memory of 2008	880	AcroRd32.exe	WerFault.exe
PID 880 wrote to memory of 2008	880	AcroRd32.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 676
2⤵
- Program crash
PID:2008

memory/880-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000000000000-mapping.dmp

Download