3de41e8d2113fc13bfc99226abb141d4116527c9e6caa2a8d8d3f7dacee42ff6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 14:25

Target

06ccf0fa22fac68c91255fe76bbb0982_JaffaCakes118.pdf
Size

12KB
MD5

06ccf0fa22fac68c91255fe76bbb0982
SHA1

ce9b126401e32a8c22d9a1fcced55880da842213
SHA256

3de41e8d2113fc13bfc99226abb141d4116527c9e6caa2a8d8d3f7dacee42ff6
SHA512

e773ad38c0b6c99673b4ea4b5254d0bde43f39f125cc5cd9206882f9ef4459e2f2d34d4e7ff08fb1b7ae9f91cd7530c4db45935726d365bbd956af98a19d2c21
SSDEEP

384:bONbedw+lJ5LjV84kk40Wp3r57tZ7titTrAm+ISCy20EkPk93:hjV84kkGPz0d0EkPkd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	1844	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2868	1844	AcroRd32.exe	28
PID 1844 wrote to memory of 2868	1844	AcroRd32.exe	28
PID 1844 wrote to memory of 2868	1844	AcroRd32.exe	28
PID 1844 wrote to memory of 2868	1844	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\06ccf0fa22fac68c91255fe76bbb0982_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 752
  2⤵
  - Program crash
  PID:2868

memory/1844-0-0x00000000033A0000-0x0000000003416000-memory.dmp

Filesize
472KB

Download