f94ad43bfd26eb178c06fa479555910f2b447fcd746efac00713ee2f413cf9b9 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c0151385c445419513a8a2433ff22ec1.pdf
Size

12KB
MD5

c0151385c445419513a8a2433ff22ec1
SHA1

87cefbcc80e77cc3e920b662e1dfac0bbd057292
SHA256

f94ad43bfd26eb178c06fa479555910f2b447fcd746efac00713ee2f413cf9b9
SHA512

c89ef17ddbb8068f8995e88db785c4f36e9941fd9212268aef32164e0bc80a6622d6f6431aaf2ea94674aace391ca021d895f44244050e12f2c0c09e6eb88236
SSDEEP

384:bONJedw+MJ5koSTHkkXAPDkNTdaZUOu9f3:sSp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	2776	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2776	AcroRd32.exe
2776	AcroRd32.exe
2776	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2536	2776	AcroRd32.exe	28
PID 2776 wrote to memory of 2536	2776	AcroRd32.exe	28
PID 2776 wrote to memory of 2536	2776	AcroRd32.exe	28
PID 2776 wrote to memory of 2536	2776	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c0151385c445419513a8a2433ff22ec1.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 760
  2⤵
  - Program crash
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-0-0x00000000033C0000-0x0000000003436000-memory.dmp

Filesize
472KB

Download