38c4325a972526cde1a369eeee620ae496f493e09f5a286274c9b49d46b51817

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:11

Target

142cb363cd287d419dda31584ed9feb5.pdf
Size

16KB
MD5

142cb363cd287d419dda31584ed9feb5
SHA1

b8f59bc7cc172a33ec5dc6e2613c65820cb44a27
SHA256

38c4325a972526cde1a369eeee620ae496f493e09f5a286274c9b49d46b51817
SHA512

a6fbd3c70cef8511cdb08d8820b033e678c67b39f122730441274d8864f5903146d64bfbe38e67a55e60ee46b0d50f48c8aa585dfe15732aa85838d5436fa882
SSDEEP

384:4ONyCeewIjJizrktDJkLSdyIYl5R3yr9EhyCk7kdyIYi8IRnLLXI0n+Rmr2ESLwe:BlZcy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	1064	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2456	1064	AcroRd32.exe	28
PID 1064 wrote to memory of 2456	1064	AcroRd32.exe	28
PID 1064 wrote to memory of 2456	1064	AcroRd32.exe	28
PID 1064 wrote to memory of 2456	1064	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\142cb363cd287d419dda31584ed9feb5.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 768
  2⤵
  - Program crash
  PID:2456

memory/1064-0-0x00000000031F0000-0x0000000003266000-memory.dmp

Filesize
472KB

Download