41e4850f82079f457824700f7ea0eb82dd2f6dd5c77c517922f820182476893a

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 04:50

Target

335b49c4ba75b896cf075db768998c38_JaffaCakes118.pdf
Size

11KB
MD5

335b49c4ba75b896cf075db768998c38
SHA1

d65cdeaf2fc7af0a8ad01315147e56b116830a04
SHA256

41e4850f82079f457824700f7ea0eb82dd2f6dd5c77c517922f820182476893a
SHA512

69fec108aac316876956065fdb6495e0def9e0c1626fb34085fcb07a5667e84b26ca6bcdf91d0a421ffa53e71a5e2c81e17fdbfe7c7d59bfdb77884ec2def431
SSDEEP

192:bONbedw+lJ5v9Rcm7+/mskxx9lcI2aGB5d3WjgNAomscooUYqI5dKNZMaQwU482k:bONbedw+lJ5VqHAxTmI2Jh3WjPTCt8Kq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	1744	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2544	1744	AcroRd32.exe	30
PID 1744 wrote to memory of 2544	1744	AcroRd32.exe	30
PID 1744 wrote to memory of 2544	1744	AcroRd32.exe	30
PID 1744 wrote to memory of 2544	1744	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\335b49c4ba75b896cf075db768998c38_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 748
  2⤵
  - Program crash
  PID:2544

memory/1744-0-0x0000000002780000-0x00000000027F6000-memory.dmp

Filesize
472KB

Download