6e00f140eaae6021e8b66331adb1e8afa6d7c2aad4ba22a4018651e05df94aa4 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 13:18

Sharing

Report Analysis Logs

General

Target

5691290dcbcc709342cb7ef18135c5a6.pdf
Size

12KB
MD5

5691290dcbcc709342cb7ef18135c5a6
SHA1

92acd532ffc26c263648d7b3bb3aa76e8fe172f2
SHA256

6e00f140eaae6021e8b66331adb1e8afa6d7c2aad4ba22a4018651e05df94aa4
SHA512

79d87582069193f9f5b5bb84daf634264c2395997d3a668f4fcff1faaa60a6826af9244a241efbc69c75c4a9c1565617c45d0855c0f64eed49f6bd8b5e4fa457
SSDEEP

384:4ONTyde03R2+6SxHI2mpQsCeewIjJiz3vEz:Hyd16SxHI2mpBvS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	2148	WerFault.exe	14

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2148	AcroRd32.exe
2148	AcroRd32.exe
2148	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2348	2148	AcroRd32.exe	25
PID 2148 wrote to memory of 2348	2148	AcroRd32.exe	25
PID 2148 wrote to memory of 2348	2148	AcroRd32.exe	25
PID 2148 wrote to memory of 2348	2148	AcroRd32.exe	25

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5691290dcbcc709342cb7ef18135c5a6.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 756
  2⤵
  - Program crash
  PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x0000000002AE0000-0x0000000002B56000-memory.dmp

Filesize
472KB

Download