c7747ff0eccecb09ac4dd55db2f97bd54802349b74fdfefdf108322bdcf80cbe

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:49

Target

1d95f2b973f47377ea21973aa5bb08ad.pdf
Size

53KB
MD5

1d95f2b973f47377ea21973aa5bb08ad
SHA1

c5932e2aa1132460a6ced53433d5b6c81fb37ef7
SHA256

c7747ff0eccecb09ac4dd55db2f97bd54802349b74fdfefdf108322bdcf80cbe
SHA512

e9525ccea23540ad67463fafdc56b5b10cbd2be586f865560f6d8bec35c83f9f168432c507e2cdc432d3abd286bb342f9361babb44003c6783f8bbaa8f1d7ef1
SSDEEP

192:bONbedw+lJ5LUlbakRZ1UsQqAjnsNqhyW23uq2Lt3:bONbedw+lJ5LUVrZ1ZxAQNqhtpq2h3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	1344	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2528	1344	AcroRd32.exe	28
PID 1344 wrote to memory of 2528	1344	AcroRd32.exe	28
PID 1344 wrote to memory of 2528	1344	AcroRd32.exe	28
PID 1344 wrote to memory of 2528	1344	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1d95f2b973f47377ea21973aa5bb08ad.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 756
  2⤵
  - Program crash
  PID:2528

memory/1344-0-0x0000000003B70000-0x0000000003BE6000-memory.dmp

Filesize
472KB

Download