c430ec9a62e9b57a2e60e66c14d14d7ce74522854ce55195d49f97aa7a7e6bd6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 03:04

Target

024490067e7dea77283ce549cda02e99_JaffaCakes118.pdf
Size

106KB
MD5

024490067e7dea77283ce549cda02e99
SHA1

85d824efab433ec6c4ad13a764aca30df1ecfc07
SHA256

c430ec9a62e9b57a2e60e66c14d14d7ce74522854ce55195d49f97aa7a7e6bd6
SHA512

2dc37cbceea5feef6d7ea0a1734dbcbb42b576a6a03004c4cfb917f9f4150d6f1077dc1a254d2ca5172213b41c5d8462a563bd2d6985fcb3a9614c007d45923c
SSDEEP

384:bONbedw+lJ5n0zDIce0H7naF/noQDV071oF0jRDUkd4KYOKVip2A8p/OBGfsh+0m:V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	1752	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2104	1752	AcroRd32.exe	28
PID 1752 wrote to memory of 2104	1752	AcroRd32.exe	28
PID 1752 wrote to memory of 2104	1752	AcroRd32.exe	28
PID 1752 wrote to memory of 2104	1752	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\024490067e7dea77283ce549cda02e99_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 752
  2⤵
  - Program crash
  PID:2104

memory/1752-0-0x0000000003E80000-0x0000000003EF6000-memory.dmp

Filesize
472KB

Download