19fdf48e152cb0e13871fac8e3f436da5675d4326911b38d1a882578e5e12391

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/02/2024, 02:23

Target
0f5d42aa99b17eabddc19a46013b517b.pdf
Size 151KB
Sample240206-cvjessdba8
SHA256 34cb88a51729a7d54d6e575ae14e184b25ee581ee15bc60775251909d63bd477
MD5 0f5d42aa99b17eabddc19a46013b517b
SHA1 7f3def64dc5cdbd90b4917ae513ed39f159114bd
SHA512 0141e8da93205395a63af10880522e9d1f85d934f5f1c69ec495f31abbe1b1e862e0d7844dfe501d6a8a2dec66246d8231ffde82dc49fa2cec16d73f3b6c691e
SSDEEP 3072:wTm4nwZgAqvBPoFmlYgsFIDJpi89qWt1ZJlYQ0ryqAkryXT:wH8gAqv6Fme/g880uZJSQ0ryqAkryXT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2776	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2748	2776	AcroRd32.exe	28
PID 2776 wrote to memory of 2748	2776	AcroRd32.exe	28
PID 2776 wrote to memory of 2748	2776	AcroRd32.exe	28
PID 2776 wrote to memory of 2748	2776	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0f5d42aa99b17eabddc19a46013b517b.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 760
  2⤵
  - Program crash
  PID:2748