55e3e8a9751647ad1da44b34d5fc44effa086730ae707fec00df110933a88e94

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 07:01

Target

fc314f436d728edd509a6c6c92251d07_JaffaCakes118.pdf
Size

16KB
MD5

fc314f436d728edd509a6c6c92251d07
SHA1

5fdc8112462fbdde6c98d01dea1c25759430fd65
SHA256

55e3e8a9751647ad1da44b34d5fc44effa086730ae707fec00df110933a88e94
SHA512

6b996332a7150232e351d2ba23516d1c6cfa55fdaa04bb709efc18fefd9dfb2e7c94785bdd64db4daa3e73f130373e8012ccfd9aaf4ccc334b482151915bdd84
SSDEEP

192:4ONyCeewIjJiz+MUSFVqGizqPHCAhvAhc7nwkU4XTa/nzLfkJQHvzjE5DF0vCal7:4ONyCeewIjJiz+9VkAlcuv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2964	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2928	2964	AcroRd32.exe	28
PID 2964 wrote to memory of 2928	2964	AcroRd32.exe	28
PID 2964 wrote to memory of 2928	2964	AcroRd32.exe	28
PID 2964 wrote to memory of 2928	2964	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fc314f436d728edd509a6c6c92251d07_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 752
  2⤵
  - Program crash
  PID:2928

memory/2964-0-0x0000000002EF0000-0x0000000002F66000-memory.dmp

Filesize
472KB

Download