a1149475f72d9ad8f303b165e49e04dfde99776732b7f3adf5fe7c008b23811a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 15:35

Target

28ac93f12328c874e2961218f3e6eab1_JaffaCakes118.pdf
Size

16KB
MD5

28ac93f12328c874e2961218f3e6eab1
SHA1

bdd851ebc18fff1bd5f676f34264f84f9211ea2d
SHA256

a1149475f72d9ad8f303b165e49e04dfde99776732b7f3adf5fe7c008b23811a
SHA512

2451b543a8f06dae08395f1db90fadb29989b825ccc545d8c47eff12b40133fbc3e887a5a9eeaf9e1f0e57dcd4e4e24a8ef2b6f31001b7f5a447291b771ea850
SSDEEP

384:4ONyCeew+jJi5DstVbV0pdaxAgTWgwGIMH8Tc1i+BIE3:PH8TchIY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	2068	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2200	2068	AcroRd32.exe	30
PID 2068 wrote to memory of 2200	2068	AcroRd32.exe	30
PID 2068 wrote to memory of 2200	2068	AcroRd32.exe	30
PID 2068 wrote to memory of 2200	2068	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\28ac93f12328c874e2961218f3e6eab1_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 756
  2⤵
  - Program crash
  PID:2200

memory/2068-0-0x0000000003070000-0x00000000030E6000-memory.dmp

Filesize
472KB

Download