86216f27c2ecef12745a59cfbfc22af6ca62b146984f1040632b07eef32184d1

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 15:18

Target

423c3092bbbf9189201f5cf9defe47d3_JaffaCakes118.pdf
Size

12KB
MD5

423c3092bbbf9189201f5cf9defe47d3
SHA1

1321186656392dd3703c5250e3448ca6a8fb204e
SHA256

86216f27c2ecef12745a59cfbfc22af6ca62b146984f1040632b07eef32184d1
SHA512

147f1c0d795b62b032acdd27470bc02b0dc6f9c65871fb3ed47c1d9b94a911d5f75d81e7416f59cbc57c048d26fae431a2854d52aef34d52a5396da36a2da0d8
SSDEEP

384:bONbedw+lJ5cNRN3nfDF9Ylmtqf0v+ujXCebhp+tAe53Ds/fcGUI2SU6wHaf2xmP:WNRNXfDF9qmK0v+ujyebhp+tAe53DQfX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	2432	WerFault.exe	28

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2868	2432	AcroRd32.exe	29
PID 2432 wrote to memory of 2868	2432	AcroRd32.exe	29
PID 2432 wrote to memory of 2868	2432	AcroRd32.exe	29
PID 2432 wrote to memory of 2868	2432	AcroRd32.exe	29

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\423c3092bbbf9189201f5cf9defe47d3_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 768
  2⤵
  - Program crash
  PID:2868

memory/2432-0-0x0000000003240000-0x00000000032B6000-memory.dmp

Filesize
472KB

Download