eb2253964ca2a0edf468693a9bdf5cd516838ac4986ce156dacd22ee92a76c4d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 08:15

Target

48f4698641e460c93d8fb5814d668eb9_JaffaCakes118.pdf
Size

106KB
MD5

48f4698641e460c93d8fb5814d668eb9
SHA1

4ff0cd206ad731fb9b6707a73c6ddc353aceb2b1
SHA256

eb2253964ca2a0edf468693a9bdf5cd516838ac4986ce156dacd22ee92a76c4d
SHA512

b06e2cc69430f9c53905388578c38e7b4ee9330e2c9094fd74331331c1752fe541ece175ad760728d005f077037df444ca96a9c620938028b2051fda4faec3a6
SSDEEP

384:bONbedw+lJ5J6ClfjcYCluoobopQmsdFT1wgPb44yCPqhqYKYpav2tlWFxTb1HgL:+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	1984	WerFault.exe	30

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2268	1984	AcroRd32.exe	31
PID 1984 wrote to memory of 2268	1984	AcroRd32.exe	31
PID 1984 wrote to memory of 2268	1984	AcroRd32.exe	31
PID 1984 wrote to memory of 2268	1984	AcroRd32.exe	31

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\48f4698641e460c93d8fb5814d668eb9_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 752
  2⤵
  - Program crash
  PID:2268

memory/1984-0-0x0000000003150000-0x00000000031C6000-memory.dmp

Filesize
472KB

Download