96e37f9c277b7c275acbd005c02e57d2bc53d9437738e4c8e283ef8f21bf2dd0 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 02:15

Sharing

Report Analysis Logs

General

Target

244ace62033c49e329ed0fa8b78da8e5_JaffaCakes118.pdf
Size

16KB
MD5

244ace62033c49e329ed0fa8b78da8e5
SHA1

201fb7b267f402fe43fa69b8b13cb5373e06a7fe
SHA256

96e37f9c277b7c275acbd005c02e57d2bc53d9437738e4c8e283ef8f21bf2dd0
SHA512

83eaef3d2b923108404f7b1878d65bb85370932fd47d6b6b7558e69d4e58bcacdba391f7f71e49048ab7a1e4150e98776c1a34a79db8619106a8d9d63debc7c8
SSDEEP

384:4ONyCeewIjJizPvB8NnZgWF+Bh4JotmEv:XS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2440	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2440	AcroRd32.exe
2440	AcroRd32.exe
2440	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2028	2440	AcroRd32.exe	28
PID 2440 wrote to memory of 2028	2440	AcroRd32.exe	28
PID 2440 wrote to memory of 2028	2440	AcroRd32.exe	28
PID 2440 wrote to memory of 2028	2440	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\244ace62033c49e329ed0fa8b78da8e5_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 756
  2⤵
  - Program crash
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-0-0x0000000002ED0000-0x0000000002F46000-memory.dmp

Filesize
472KB

Download