acdddd3491c59ad48c012878dd0b2129b3d3df8a66cd845a34ae876c809404df | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 11:04

Sharing

Report Analysis Logs

General

Target

a39ea5d822265270de78b3659e0be6a7.pdf
Size

12KB
MD5

a39ea5d822265270de78b3659e0be6a7
SHA1

17ca2a7531a043dc9ca995f4ecf1ca528918a7b9
SHA256

acdddd3491c59ad48c012878dd0b2129b3d3df8a66cd845a34ae876c809404df
SHA512

a028aa5a97177e12a53a3940def2d98602d0c2da77c63e6a4bc39036149958c6fd584e4722b86f3a0f73064aff88cc6fa4c92e39833de31eb76246914c004385
SSDEEP

384:bONbedw+lJ5W4imHmomOmem7mlBZ1fqtIAtk7rNy33:hBnfqtIAtk7rNyH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	1288	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1288	AcroRd32.exe
1288	AcroRd32.exe
1288	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2136	1288	AcroRd32.exe	28
PID 1288 wrote to memory of 2136	1288	AcroRd32.exe	28
PID 1288 wrote to memory of 2136	1288	AcroRd32.exe	28
PID 1288 wrote to memory of 2136	1288	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a39ea5d822265270de78b3659e0be6a7.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 752
  2⤵
  - Program crash
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-0-0x00000000032F0000-0x0000000003366000-memory.dmp

Filesize
472KB

Download