67f0867cab233b5fe345c9ad1cefac8c44c06dda0e35bd44f956824aa0a60453

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 11:53

Target

f37082a19bdfb85e9a9d682a50774da4_JaffaCakes118.pdf
Size

132KB
MD5

f37082a19bdfb85e9a9d682a50774da4
SHA1

690725299ca8aecd5eb84034b494ceb946006e48
SHA256

67f0867cab233b5fe345c9ad1cefac8c44c06dda0e35bd44f956824aa0a60453
SHA512

2ef518d40a0b9f53384636e5e49a3c9f5bb14d10ea9da3496061140789523e98e8a43f485a6e7b7ea3c2729fc51226d0b9319481b047071949155eaba93dcc14
SSDEEP

384:bONbedw+lJ5Q5lcC9QKZVxjp1+1VTAyi4cpWeAPr2Lid3:+5lcC9xZVxjp1+1VEyi4cpWhPr2Li9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2088	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3060	2088	AcroRd32.exe	28
PID 2088 wrote to memory of 3060	2088	AcroRd32.exe	28
PID 2088 wrote to memory of 3060	2088	AcroRd32.exe	28
PID 2088 wrote to memory of 3060	2088	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f37082a19bdfb85e9a9d682a50774da4_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 756
  2⤵
  - Program crash
  PID:3060

memory/2088-0-0x0000000002850000-0x00000000028C6000-memory.dmp

Filesize
472KB

Download