19fdf48e152cb0e13871fac8e3f436da5675d4326911b38d1a882578e5e12391

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/02/2024, 02:23

Target
004e74d54dcf79c641d5cf8a615488a0.pdf
Size 115KB
Sample240206-cvjessdba8
SHA256 ba79bdf796b57696cc9f9f61ef00bb2c0fd21e2f2188a29a17dff00f9f0fad7f
MD5 004e74d54dcf79c641d5cf8a615488a0
SHA1 6413fbe0d90cb7f445f76dc8d1ccaacddd55df4a
SHA512 7b65d9d49dd27706948cd321cf873279cb0ef6e36d62f90095b9d7280b0f7bbee93827601e0ddabcf2850184483a43eabb71a02d71f4b48df6980c650fbfc0e6
SSDEEP 3072:bxb9EwZtg9daX+RVaMyvjCNUUAtkBrryl5Fi:FaDdusV/yv8/Y0rp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	2932	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3052	2932	AcroRd32.exe	28
PID 2932 wrote to memory of 3052	2932	AcroRd32.exe	28
PID 2932 wrote to memory of 3052	2932	AcroRd32.exe	28
PID 2932 wrote to memory of 3052	2932	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\004e74d54dcf79c641d5cf8a615488a0.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 756
  2⤵
  - Program crash
  PID:3052