3e0bd8aa69e66542af114d7190e56d051732e02db4cef8d976743cf8298a835a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 06:19

Target

039399835c1faaadc00e67e8170557c9_JaffaCakes118.pdf
Size

15KB
MD5

039399835c1faaadc00e67e8170557c9
SHA1

93c24bbc3b7e8127721a057aea4715fb4b40a268
SHA256

3e0bd8aa69e66542af114d7190e56d051732e02db4cef8d976743cf8298a835a
SHA512

05a34654f25ff570a9262eccab3fc9253ef23bba3fcb05f882b198e377f2ae0ec1a04aa418eda0bea69c05d4f25280a5a8b3bb274af68908ddad79654fecf314
SSDEEP

192:4ONyCeewIjJizHvypXBWWrVrcaFH2e4roedrorhpfRLdFUYm8PrnrcVZrx1kY0oO:4ONyCeewIjJizapxuI1eGBk0or/Ev

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	1380	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2324	1380	AcroRd32.exe	28
PID 1380 wrote to memory of 2324	1380	AcroRd32.exe	28
PID 1380 wrote to memory of 2324	1380	AcroRd32.exe	28
PID 1380 wrote to memory of 2324	1380	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\039399835c1faaadc00e67e8170557c9_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 752
  2⤵
  - Program crash
  PID:2324

memory/1380-0-0x0000000002D00000-0x0000000002D76000-memory.dmp

Filesize
472KB

Download