41b961d1f48bf3e85f0f1ae1d16a689639550825e29b2968113a9548e73931ef

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 12:50

Target

49daa0d702df08b38712e032cb70413c_JaffaCakes118.pdf
Size

61KB
MD5

49daa0d702df08b38712e032cb70413c
SHA1

e677e422dc3abdcfe46d78bf7761f72c97161d97
SHA256

41b961d1f48bf3e85f0f1ae1d16a689639550825e29b2968113a9548e73931ef
SHA512

befda2792bf4820cf786da87eeed0d2d455d0022eaeb26216ce44a973e1cc216b1b2029d73aece0fac0f9564a76d7b5df31282a025b34426d5886d85b4e012ea
SSDEEP

192:bONbedw+DJ5X1LQOD9D7TM+4xP5DTkNzIbyvYkle0vvkUW4YTpCjjn8kNn/hJNF1:bONbedw+DJ5pbWRupT4cZ3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1748	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2172	1748	AcroRd32.exe	30
PID 1748 wrote to memory of 2172	1748	AcroRd32.exe	30
PID 1748 wrote to memory of 2172	1748	AcroRd32.exe	30
PID 1748 wrote to memory of 2172	1748	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\49daa0d702df08b38712e032cb70413c_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 752
  2⤵
  - Program crash
  PID:2172

memory/1748-0-0x0000000003B00000-0x0000000003B76000-memory.dmp

Filesize
472KB

Download