e72820c7caa9e7bad41b12b2c3aa7171755840c35447d8cc0536a6012973c195 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

269829aeaf9206a2e9b217477e0cd684.pdf
Size

3KB
MD5

269829aeaf9206a2e9b217477e0cd684
SHA1

6b874664e21d9c2c358110cbd8c4e2c43126424a
SHA256

e72820c7caa9e7bad41b12b2c3aa7171755840c35447d8cc0536a6012973c195
SHA512

52d21a952c0e4cd98bbffdc3773d39b20ff4c0a8990f23134eff15d684833895cdde9eb7debae47c99d039e333695d7c12a0a5bfc250217931f6a2abb01790b0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2928	WerFault.exe	14

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2928	AcroRd32.exe
2928	AcroRd32.exe
2928	AcroRd32.exe
2928	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2524	2928	AcroRd32.exe	28
PID 2928 wrote to memory of 2524	2928	AcroRd32.exe	28
PID 2928 wrote to memory of 2524	2928	AcroRd32.exe	28
PID 2928 wrote to memory of 2524	2928	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\269829aeaf9206a2e9b217477e0cd684.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 772
  2⤵
  - Program crash
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads