30d444f8530fbd91f8014ad5a131172a66cd8bfce3cb9d6c5d4f9905e939423d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:17

Target

6ddf219c72579f0a030f4f10cafc4d8f.pdf
Size

15KB
MD5

6ddf219c72579f0a030f4f10cafc4d8f
SHA1

623e2a580968092631e0d83f571256606a68fac6
SHA256

30d444f8530fbd91f8014ad5a131172a66cd8bfce3cb9d6c5d4f9905e939423d
SHA512

866c91a37cdeadd0a114bc8c9cc60947ff07add83c00be1446386b4590de9817c0cf619077196d9a57b8f0ee7c2196d68fd7bc421ccc9cf56df20ac5969a71d6
SSDEEP

384:4ONyCeewIjJizTeBl/RZ9d6eHjqoeA378CwwXnzn8+DCRWjajwtdWj8Sawkkk1S4:7US

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2172	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2688	2172	AcroRd32.exe	28
PID 2172 wrote to memory of 2688	2172	AcroRd32.exe	28
PID 2172 wrote to memory of 2688	2172	AcroRd32.exe	28
PID 2172 wrote to memory of 2688	2172	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6ddf219c72579f0a030f4f10cafc4d8f.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 764
  2⤵
  - Program crash
  PID:2688

memory/2172-0-0x0000000003200000-0x0000000003276000-memory.dmp

Filesize
472KB

Download