3d098273531877f6bac89d07c1a5041f052c4371fce28588d25bf7825bc33c76

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 06:23

Target

48978a78b999a803ca794f02f3bf22ac_JaffaCakes118.pdf
Size

4KB
MD5

48978a78b999a803ca794f02f3bf22ac
SHA1

1b3e3f545038575c85f13cd2c1816e8872905b8c
SHA256

3d098273531877f6bac89d07c1a5041f052c4371fce28588d25bf7825bc33c76
SHA512

31c029d2dd23c0552f13e15514a24ea7aac839d840eb46308e84414938c2b4da2195361da269b1304cecdcc5277b0f2c970e84223efc1aaa916ba4462ea9d8b7
SSDEEP

48:kwc393agTagNzgxJ9OWDO7zlfo3qk6Lb3xy51BfD/5de03WGd1ryi5QjSi5uQ66B:kwcwJZ8pdk6v3Y/e03p+wDTI14Rr+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	2232	WerFault.exe	30

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2844	2232	AcroRd32.exe	31
PID 2232 wrote to memory of 2844	2232	AcroRd32.exe	31
PID 2232 wrote to memory of 2844	2232	AcroRd32.exe	31
PID 2232 wrote to memory of 2844	2232	AcroRd32.exe	31

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\48978a78b999a803ca794f02f3bf22ac_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 764
  2⤵
  - Program crash
  PID:2844