2b7aad44ec5de0714e1367501a17c86048a3fc36e5fd6d0f82f83520c7fb4c8b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 09:07

Target

0d7bd64df005565dece035d6d5e0a4a7_JaffaCakes118.pdf
Size

12KB
MD5

0d7bd64df005565dece035d6d5e0a4a7
SHA1

2ef81745a4f2730ad44b7703ca686acbd38533d9
SHA256

2b7aad44ec5de0714e1367501a17c86048a3fc36e5fd6d0f82f83520c7fb4c8b
SHA512

8bd69a1b931da06d48d3e65d9291972af452e7df2dd49994c235c2362221dc62084becb0f1a770fb4c0b375052a5ed938eaef552d430ad7ec1a7f877708d3559
SSDEEP

192:bONbedw+lJ5F9cQna7oZ4X8rgeII11vPUfLK9nXu3:bONbedw+lJ5F99n+o5G3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	1768	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2588	1768	AcroRd32.exe	28
PID 1768 wrote to memory of 2588	1768	AcroRd32.exe	28
PID 1768 wrote to memory of 2588	1768	AcroRd32.exe	28
PID 1768 wrote to memory of 2588	1768	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0d7bd64df005565dece035d6d5e0a4a7_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 752
  2⤵
  - Program crash
  PID:2588

memory/1768-0-0x0000000002AA0000-0x0000000002B16000-memory.dmp

Filesize
472KB

Download