efe8310ff534540ff3d72721002e7d94fe14566cd1fb3b279130f539a7926309

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 10:32 UTC

Target

2bfeb3a651b6d0f2e41897537e8a8e6b_JaffaCakes118.pdf
Size

132KB
MD5

2bfeb3a651b6d0f2e41897537e8a8e6b
SHA1

0aa6a75874093c479757965cbeb211fecd3ae47f
SHA256

efe8310ff534540ff3d72721002e7d94fe14566cd1fb3b279130f539a7926309
SHA512

d3eacffa237c6df4602bafc6fe51a3f542fb163dc9f22f6f51dc8b78a7d72adeb91db7f1af3cb8bbaae717f559ffa33ea52a9b384bee70e8247f5a623571bce3
SSDEEP

768:KUTdyaLZJVGvZ8smmNHhU6dBM4V4y2dPQfLH2xewXhh0h5iHB4iEywdSb0uD:X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	2936	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1628	2936	AcroRd32.exe	28
PID 2936 wrote to memory of 1628	2936	AcroRd32.exe	28
PID 2936 wrote to memory of 1628	2936	AcroRd32.exe	28
PID 2936 wrote to memory of 1628	2936	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2bfeb3a651b6d0f2e41897537e8a8e6b_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 756
  2⤵
  - Program crash
  PID:1628

memory/2936-0-0x0000000002CD0000-0x0000000002D46000-memory.dmp

Filesize
472KB

Download