3b2a449443b517ca4b6ab282d0a9917c6b66f5fdcf2a78c68f4e631d5ffcf959

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 09:08

Target

410e3629d0bc3165df72c02268a2b16f_JaffaCakes118.pdf
Size

87KB
MD5

410e3629d0bc3165df72c02268a2b16f
SHA1

c068dae4ac01670f27834c570c214121020de382
SHA256

3b2a449443b517ca4b6ab282d0a9917c6b66f5fdcf2a78c68f4e631d5ffcf959
SHA512

ea22209ba760c0187f56fd5dc30d7a1526a62917d8260f33d4eb8256ddf25c70002b527b8ef7c64168dd421464299cb28a7b922f33166744697c3a393b846226
SSDEEP

384:bONbedw+lJ5T5wlAcRveh1x3SLGEBOqRqkGYiz32pkTiJ1LuT+7Iq9COd0jts3:S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2388	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2676	2388	AcroRd32.exe	30
PID 2388 wrote to memory of 2676	2388	AcroRd32.exe	30
PID 2388 wrote to memory of 2676	2388	AcroRd32.exe	30
PID 2388 wrote to memory of 2676	2388	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\410e3629d0bc3165df72c02268a2b16f_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 760
  2⤵
  - Program crash
  PID:2676

memory/2388-0-0x00000000032E0000-0x0000000003356000-memory.dmp

Filesize
472KB

Download