c7eeb2a8224c8a6128ebfc91af4c0355e1196f46960c3cc98f2f4f1a3e1253f5

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 06:36

Target

40926140f80fb38efd6c83ac52449df1_JaffaCakes118.pdf
Size

132KB
MD5

40926140f80fb38efd6c83ac52449df1
SHA1

d81ff2cbc66996d8f547b32e7ebd8367f72a48e1
SHA256

c7eeb2a8224c8a6128ebfc91af4c0355e1196f46960c3cc98f2f4f1a3e1253f5
SHA512

f513cc281999be8231461efdec3408e5c4127079a99b80a3efa2c3bed2de6c21fee6820c5f23254a79d37f487843672e37c82deaacf17ec507dc4891e50b361b
SSDEEP

384:bONbedw+lJ5acWeJnUlK9sbAOpuyuVpuFuS2l9/2uODrD4SaEyuSb6OLOq9D2ckQ:drF2CNu/WOEcjJeFVz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	1700	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2356	1700	AcroRd32.exe	30
PID 1700 wrote to memory of 2356	1700	AcroRd32.exe	30
PID 1700 wrote to memory of 2356	1700	AcroRd32.exe	30
PID 1700 wrote to memory of 2356	1700	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\40926140f80fb38efd6c83ac52449df1_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 752
  2⤵
  - Program crash
  PID:2356

memory/1700-0-0x0000000003580000-0x00000000035F6000-memory.dmp

Filesize
472KB

Download