6b4e32ee48e0b3f1ceafb2e6f9a8e9a9bf8cf2f424041b6c35558dc450c64b4d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 12:54

Target

34ceb4cf4f7847291378bbd48585d467_JaffaCakes118.pdf
Size

12KB
MD5

34ceb4cf4f7847291378bbd48585d467
SHA1

07bc9bb6e0c72d2acc5e3dfe5c6c0aae7ab2c961
SHA256

6b4e32ee48e0b3f1ceafb2e6f9a8e9a9bf8cf2f424041b6c35558dc450c64b4d
SHA512

564713b042482046abf496dd02bbacc67cec1c81cc29f4869274df69383519a918c9a3052895642932ea54dd4636b8ce824ca60ac6da80424914c40f6bbff8df
SSDEEP

192:bONbedw+lJ5zanHLFFCXAcN/03SvAMRfV3NiHV3:bONbedw+lJ5Sf8N6V3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	1740	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1624	1740	AcroRd32.exe	30
PID 1740 wrote to memory of 1624	1740	AcroRd32.exe	30
PID 1740 wrote to memory of 1624	1740	AcroRd32.exe	30
PID 1740 wrote to memory of 1624	1740	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\34ceb4cf4f7847291378bbd48585d467_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 756
  2⤵
  - Program crash
  PID:1624

memory/1740-0-0x0000000003E40000-0x0000000003EB6000-memory.dmp

Filesize
472KB

Download