a2384d5683d1b9b7bd44c5fce809966c020b60faf6c03aa4c5be15974eba0bca

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 22:42

Target

36b0d5df899ef8596f5c68c494e7e2fb_JaffaCakes118.pdf
Size

15KB
MD5

36b0d5df899ef8596f5c68c494e7e2fb
SHA1

7cc9c182d30715da5388f5d442d3002bb57abad6
SHA256

a2384d5683d1b9b7bd44c5fce809966c020b60faf6c03aa4c5be15974eba0bca
SHA512

a8dde7fe2520f44f69d9289f0eb2243df66941f5a54fd03cb9c8e92965ce18d30bef11b2c2cea7a7d9603b554e809351bad959ceaac1027c350065df0b332db3
SSDEEP

192:4ONyCeewIjJizsONJwm3IbKo8TJsA++cGz1lhrnJkZXKSYdC67L0SahOgEv:4ONyCeewIjJizR43UTvvkZXKqQgEv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1832	2524	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1832	2524	AcroRd32.exe	30
PID 2524 wrote to memory of 1832	2524	AcroRd32.exe	30
PID 2524 wrote to memory of 1832	2524	AcroRd32.exe	30
PID 2524 wrote to memory of 1832	2524	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\36b0d5df899ef8596f5c68c494e7e2fb_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 752
  2⤵
  - Program crash
  PID:1832

memory/2524-0-0x00000000035F0000-0x0000000003666000-memory.dmp

Filesize
472KB

Download