8d9fa665fc0d83a80be4caf6cef95eb30fb005e4e07a25970d4ff0c9b9a9111c

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 08:18

Target

4504b2ec14ac506058b4304a418d37dd_JaffaCakes118.pdf
Size

36KB
MD5

4504b2ec14ac506058b4304a418d37dd
SHA1

8fbaf5b96f983a4df6caa13a5fbf72de8991109c
SHA256

8d9fa665fc0d83a80be4caf6cef95eb30fb005e4e07a25970d4ff0c9b9a9111c
SHA512

ec45273ccfcc82abd06400d5a8f418c128b730b2700bdb7f78e38dd2812a2bcc9d673d6fff241fddacd6fedf6d8c882088bb9409ad5da7e91ac5578ce62a30d5
SSDEEP

768:Gb/uYXEE+BsT01MtTe1RM33xSeXYhTOFvxr9iSgUhQmQkQTHsVGYOaK:lEjT0e0+3k+YyDjRbE2a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2696	WerFault.exe	29

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2800	2696	AcroRd32.exe	30
PID 2696 wrote to memory of 2800	2696	AcroRd32.exe	30
PID 2696 wrote to memory of 2800	2696	AcroRd32.exe	30
PID 2696 wrote to memory of 2800	2696	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4504b2ec14ac506058b4304a418d37dd_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 816
  2⤵
  - Program crash
  PID:2800

memory/2696-0-0x0000000004240000-0x00000000042B6000-memory.dmp

Filesize
472KB

Download