d738dcb7c9a208ad17109b0c3706688435d2670897b5f39183b8db2e3768eab9

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 02:59

Target

ca4eed1a31c75427b1dfc9ca7ec11baa.pdf
Size

52KB
MD5

ca4eed1a31c75427b1dfc9ca7ec11baa
SHA1

12dd6c9cbb4bc2526b13885a7aad976256500e31
SHA256

d738dcb7c9a208ad17109b0c3706688435d2670897b5f39183b8db2e3768eab9
SHA512

8eac4ef796cdb1e94194f7694b97c437c0925d4bb6199ba5936eccb9ed0f981dadb1bf2dc80c9ed07702da3523f289476a806c3443913e6423b1f15fa88a82a4
SSDEEP

192:bONbedw+lJ5xMjmXbQQ2/IxQo2D9xIIo02o4o8oKo72o3ovGeaNf3:bONbedw+lJ5Uxz2Dt1O2I53

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2080	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2688	2080	AcroRd32.exe	28
PID 2080 wrote to memory of 2688	2080	AcroRd32.exe	28
PID 2080 wrote to memory of 2688	2080	AcroRd32.exe	28
PID 2080 wrote to memory of 2688	2080	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ca4eed1a31c75427b1dfc9ca7ec11baa.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 764
  2⤵
  - Program crash
  PID:2688

memory/2080-0-0x00000000029D0000-0x0000000002A46000-memory.dmp

Filesize
472KB

Download