03bb4f526f8e76ed2eeb58b2fbea4cea832fc17de13898cad2fa6c4a205738c3 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 23:21

Sharing

Report Analysis Logs

General

Target

1fd4b0bb257322e8fecfc4b02cc4ad7f.pdf
Size

16KB
MD5

1fd4b0bb257322e8fecfc4b02cc4ad7f
SHA1

39a826118080297bfca311b7074d5bbd1d7d08b1
SHA256

03bb4f526f8e76ed2eeb58b2fbea4cea832fc17de13898cad2fa6c4a205738c3
SHA512

4c0d62b442a8c75cfbfb8f40d4fba776a99643b241cf516d0504f5c02fa53b3a8fc8ef981adf7ccb4cea4498bb82612e25f72a6f0690ce6e0a8c6f152b4dff9d
SSDEEP

384:4ONyCeewIjJizbVkOcLNilxmcUz92BfAqyr/cQgTM/xv:Rkgp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2668	WerFault.exe	22

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe
2668	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2676	2668	AcroRd32.exe	28
PID 2668 wrote to memory of 2676	2668	AcroRd32.exe	28
PID 2668 wrote to memory of 2676	2668	AcroRd32.exe	28
PID 2668 wrote to memory of 2676	2668	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1fd4b0bb257322e8fecfc4b02cc4ad7f.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 752
  2⤵
  - Program crash
  PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-0-0x00000000031E0000-0x0000000003256000-memory.dmp

Filesize
472KB

Download