975680294851801dbce9b327010f86bb007536142a9e3d5083bc29337a2b1e7f | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 03:29

Sharing

Report Analysis Logs

General

Target

3bd623104fb82929f542abbd520554ef_JaffaCakes118.pdf
Size

3KB
MD5

3bd623104fb82929f542abbd520554ef
SHA1

838fa879af41666f3fbfa63b39b8525c3a5839c6
SHA256

975680294851801dbce9b327010f86bb007536142a9e3d5083bc29337a2b1e7f
SHA512

ac47154bdd0f46a7c561fc5e041b4a9f9074f46f73272add1c30e4ada2e885ee8320d25dfcdf9e514de05ced05481fa2d71262a98e1711f2b22f9551e7270df3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	2548	WerFault.exe	29

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2548	AcroRd32.exe
2548	AcroRd32.exe
2548	AcroRd32.exe
2548	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2144	2548	AcroRd32.exe	30
PID 2548 wrote to memory of 2144	2548	AcroRd32.exe	30
PID 2548 wrote to memory of 2144	2548	AcroRd32.exe	30
PID 2548 wrote to memory of 2144	2548	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3bd623104fb82929f542abbd520554ef_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 760
  2⤵
  - Program crash
  PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads