0e05a3f4433f61146bbf8f6503faafd66cb6096a101f847f0e56348879d2f5ce

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 09:46

Target

ae353bd8751797dec4dcd1568934cce2.pdf
Size

11KB
MD5

ae353bd8751797dec4dcd1568934cce2
SHA1

e6ba9648e4b5360528aee9c9d41b429ef6f5f588
SHA256

0e05a3f4433f61146bbf8f6503faafd66cb6096a101f847f0e56348879d2f5ce
SHA512

696f4a0977db7b6fd246676fa463658de0ecf59550499c6e282855dd494fc89c28bf91679ecea9b029f81d511375786ec03dd1eddb4fad5571f4e07ded2686b0
SSDEEP

192:bONbedw+lJ5oML808v8xk8m8wLu8biWXO6w/V8wH88/88Me682uF88bv88D88sJR:bONbedw+lJ5YL5iWe6w/FUeEigdz53

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	1444	WerFault.exe	25

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2576	1444	AcroRd32.exe	28
PID 1444 wrote to memory of 2576	1444	AcroRd32.exe	28
PID 1444 wrote to memory of 2576	1444	AcroRd32.exe	28
PID 1444 wrote to memory of 2576	1444	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ae353bd8751797dec4dcd1568934cce2.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 760
  2⤵
  - Program crash
  PID:2576

memory/1444-0-0x0000000003F70000-0x0000000003FE6000-memory.dmp

Filesize
472KB

Download