d39f5e2933179798e860db5cbc83db1b5d168f025eb0d06314acfb684add9949

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 17:30

Target

2d3608ae832d94123eac0b8d188bb2ed_JaffaCakes118.pdf
Size

7KB
MD5

2d3608ae832d94123eac0b8d188bb2ed
SHA1

5082516f7c40ab9b89f142cfde5a5285fbc370a8
SHA256

d39f5e2933179798e860db5cbc83db1b5d168f025eb0d06314acfb684add9949
SHA512

e8b17235e623f58c583d0751294bc24d8c846119f7a699349dde257a24ba7c545fa78e51b9dacdb8fecd999a60b4fce70b17547c8900f4dffa2cb36a01dcfcf3
SSDEEP

192:6pD7woP1QHtNHZcXa0jB9Rzo0Xgdn8uQnHU7e8EsVdzr:6pYotQNxaS0Xgdn8uQn072sVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	2092	WerFault.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2092	AcroRd32.exe
2092	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2060	2092	AcroRd32.exe	31
PID 2092 wrote to memory of 2060	2092	AcroRd32.exe	31
PID 2092 wrote to memory of 2060	2092	AcroRd32.exe	31
PID 2092 wrote to memory of 2060	2092	AcroRd32.exe	31

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2d3608ae832d94123eac0b8d188bb2ed_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 680
  2⤵
  - Program crash
  PID:2060