03d1925f2e6cad8f84ce6f59b3a4b921be494088f98fab403db0ca5239db0c95 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

458b9c9a7853b4aef5b377d44a1f7bff_JaffaCakes118.pdf
Size

105KB
MD5

458b9c9a7853b4aef5b377d44a1f7bff
SHA1

63372bf1349265aca9b568fa70d5245108cd5360
SHA256

03d1925f2e6cad8f84ce6f59b3a4b921be494088f98fab403db0ca5239db0c95
SHA512

75d7babee0f2349bc9e8432f8bbb9aea7aa07ad95dee7193c242642ddcf76568fa3fee3e19eec3a41ebdffb6390d58208a68c04292b5eea4098461a7db8f1c18
SSDEEP

384:bONbedw+lJ5XC6zeCL3lOqS8uBClKGmWdVeWEh53:I

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	2400	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2400	AcroRd32.exe
2400	AcroRd32.exe
2400	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1672	2400	AcroRd32.exe	30
PID 2400 wrote to memory of 1672	2400	AcroRd32.exe	30
PID 2400 wrote to memory of 1672	2400	AcroRd32.exe	30
PID 2400 wrote to memory of 1672	2400	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\458b9c9a7853b4aef5b377d44a1f7bff_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 752
  2⤵
  - Program crash
  PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-0-0x00000000033C0000-0x0000000003436000-memory.dmp

Filesize
472KB

Download