5031fb9a8f68ac4d8c6d1e5f8f0b763086a19c47ecb24681312a88046106b93f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 14:05

Target

4623dbc48593460bcc4b9d31df7b77ad_JaffaCakes118.pdf
Size

87KB
MD5

4623dbc48593460bcc4b9d31df7b77ad
SHA1

2ca2eb7f419ae31ac841d1e2ccc7deb0319fffb6
SHA256

5031fb9a8f68ac4d8c6d1e5f8f0b763086a19c47ecb24681312a88046106b93f
SHA512

1f15f47c5fe6869f46b0df51db0b769db3bcf75f267120496b6a021459f4b6e47a6d349646c29625441d208e479b8eb9114d6d4e852b46821f58d0dd44ecd33a
SSDEEP

96:bON06mxdw+B/J57ouUalNyDPzhXEz78jqm8+kWGt4pNWsEw4uJ48CKhRod7Ox7M9:bONbedw+lJ57oQ/cGhKgyi1OVLiZ3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1648	WerFault.exe	30

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1720	1648	AcroRd32.exe	31
PID 1648 wrote to memory of 1720	1648	AcroRd32.exe	31
PID 1648 wrote to memory of 1720	1648	AcroRd32.exe	31
PID 1648 wrote to memory of 1720	1648	AcroRd32.exe	31

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4623dbc48593460bcc4b9d31df7b77ad_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 756
  2⤵
  - Program crash
  PID:1720

memory/1648-0-0x0000000002910000-0x0000000002986000-memory.dmp

Filesize
472KB

Download