Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 12:17
Behavioral task
behavioral1
Sample
6ddf219c72579f0a030f4f10cafc4d8f.pdf
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6ddf219c72579f0a030f4f10cafc4d8f.pdf
Resource
win10v2004-20231222-en
6 signatures
150 seconds
General
-
Target
6ddf219c72579f0a030f4f10cafc4d8f.pdf
-
Size
15KB
-
MD5
6ddf219c72579f0a030f4f10cafc4d8f
-
SHA1
623e2a580968092631e0d83f571256606a68fac6
-
SHA256
30d444f8530fbd91f8014ad5a131172a66cd8bfce3cb9d6c5d4f9905e939423d
-
SHA512
866c91a37cdeadd0a114bc8c9cc60947ff07add83c00be1446386b4590de9817c0cf619077196d9a57b8f0ee7c2196d68fd7bc421ccc9cf56df20ac5969a71d6
-
SSDEEP
384:4ONyCeewIjJizTeBl/RZ9d6eHjqoeA378CwwXnzn8+DCRWjajwtdWj8Sawkkk1S4:7US
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2688 2172 WerFault.exe 27 -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2172 AcroRd32.exe 2172 AcroRd32.exe 2172 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2688 2172 AcroRd32.exe 28 PID 2172 wrote to memory of 2688 2172 AcroRd32.exe 28 PID 2172 wrote to memory of 2688 2172 AcroRd32.exe 28 PID 2172 wrote to memory of 2688 2172 AcroRd32.exe 28
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6ddf219c72579f0a030f4f10cafc4d8f.pdf"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 7642⤵
- Program crash
PID:2688
-