a45930e10bd17461fa6f6b3d44bf89416e9d8667e02359711731e1994c465244

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 11:17

Target

eaf0d39b50f3762fade3e7735a8e2731_JaffaCakes118.pdf
Size

117KB
MD5

eaf0d39b50f3762fade3e7735a8e2731
SHA1

81e9824dce66c4c93e90800b9d0338030c823a9d
SHA256

a45930e10bd17461fa6f6b3d44bf89416e9d8667e02359711731e1994c465244
SHA512

db3ccdcfeb9e2f06f7772496c13ef1bdf38dabb7b5cfa71d97bcfbe9551b5becf122fd7ad538e273544d8582689f95d9a85b4c477f6a992f6c4a9f85ee7710ae
SSDEEP

192:bONJedw+jJi5Imw4mFT1TTjwR2kmnAkmmmmkmhkmpCkmoRkmX9ukm+uQEmM4Vkmh:bONJedw+jJi5+VesEg3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	1632	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2644	1632	AcroRd32.exe	28
PID 1632 wrote to memory of 2644	1632	AcroRd32.exe	28
PID 1632 wrote to memory of 2644	1632	AcroRd32.exe	28
PID 1632 wrote to memory of 2644	1632	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eaf0d39b50f3762fade3e7735a8e2731_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 756
  2⤵
  - Program crash
  PID:2644

memory/1632-0-0x0000000003020000-0x0000000003096000-memory.dmp

Filesize
472KB

Download