c951b5b7b2e5e6aa4167c9481c21adc0883004ae4290b8afdad59428f7617d0f

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 10:55

Target

7a0c43fdecdcdbbfefcdd7573887d683.pdf
Size

132KB
MD5

7a0c43fdecdcdbbfefcdd7573887d683
SHA1

0a6900bcdf0371861ee62616495f58dd021707fb
SHA256

c951b5b7b2e5e6aa4167c9481c21adc0883004ae4290b8afdad59428f7617d0f
SHA512

4a50d4297cdbc5f309335350c56c8b224adee2e330bd6dccf5d92649095554a0e02c10da164338e331b76890c58ddb4b0dd20af256130fe0a3dd2253e44b6a09
SSDEEP

384:bONbedw+lJ5X0WdKIcn7KJ85ynC0FWWLR5dnzqnhKAYzLUPaPqkohWEfybBlzPng:5NqxgpS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	2060	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2732	2060	AcroRd32.exe	28
PID 2060 wrote to memory of 2732	2060	AcroRd32.exe	28
PID 2060 wrote to memory of 2732	2060	AcroRd32.exe	28
PID 2060 wrote to memory of 2732	2060	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7a0c43fdecdcdbbfefcdd7573887d683.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 756
  2⤵
  - Program crash
  PID:2732

memory/2060-0-0x0000000003790000-0x0000000003806000-memory.dmp

Filesize
472KB

Download