859f2bda381d9f82bbd8ae143b669bd5a0236ca5c01344bfc4e1a36f7383820a

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 00:08

Target

475fc46a689ac88242eeb72c59202f77_JaffaCakes118.pdf
Size

106KB
MD5

475fc46a689ac88242eeb72c59202f77
SHA1

f6a7e94284b1eabe7e44b8f5504443f52a5d6633
SHA256

859f2bda381d9f82bbd8ae143b669bd5a0236ca5c01344bfc4e1a36f7383820a
SHA512

30e2dafb7e10b3c144d9a3b9095c6615362987f2aa606c998393cf33b916de46aff9ca60abf4b6c640786d6c22e2de1112448b655aab39359287af8db7852759
SSDEEP

384:bONbedw+lJ5GGX6bvDQ6cjCT8yIl6J6oovYUUggI6AX6GX46oZ6HOl7q0466Xokw:e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	3032	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2836	3032	AcroRd32.exe	30
PID 3032 wrote to memory of 2836	3032	AcroRd32.exe	30
PID 3032 wrote to memory of 2836	3032	AcroRd32.exe	30
PID 3032 wrote to memory of 2836	3032	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\475fc46a689ac88242eeb72c59202f77_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 760
  2⤵
  - Program crash
  PID:2836

memory/3032-0-0x0000000002660000-0x00000000026D6000-memory.dmp

Filesize
472KB

Download