3995fb036b1d25465eb044dedc821828c063e4a5297ddbbc559c47b9a9e6e848

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 05:32

Target

2b26ddc656dbcf5b12ecde6d1c5c8726_JaffaCakes118.pdf
Size

12KB
MD5

2b26ddc656dbcf5b12ecde6d1c5c8726
SHA1

d865c4e94e153fa2c2088a4569bf6946cea7fa99
SHA256

3995fb036b1d25465eb044dedc821828c063e4a5297ddbbc559c47b9a9e6e848
SHA512

36ae95827abaf0bf9c7f9ba4646190269cd05e0fcc005f7b737be2ce6898125131b9ff45139fe7b803b198f458225f023178e5bb7425c48962b24767f65f11f4
SSDEEP

384:bONbedw+lJ5Q+RIIGRv2A7qFiP4aNTNmJNo/DD8B3t3:G+RI1v2A7qFiP4aNTNmJNo/DD8B3N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	2156	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1712	2156	AcroRd32.exe	30
PID 2156 wrote to memory of 1712	2156	AcroRd32.exe	30
PID 2156 wrote to memory of 1712	2156	AcroRd32.exe	30
PID 2156 wrote to memory of 1712	2156	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2b26ddc656dbcf5b12ecde6d1c5c8726_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 756
  2⤵
  - Program crash
  PID:1712

memory/2156-0-0x0000000003020000-0x0000000003096000-memory.dmp

Filesize
472KB

Download