3850c3fb21ba8fbcc137ca61a87877e5b05eebc204cd1ccafd03fab0928de7e8

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 14:26

Target

4a0ffa7638a53a4d6a51288acadcce11_JaffaCakes118.pdf
Size

11KB
MD5

4a0ffa7638a53a4d6a51288acadcce11
SHA1

cac862d01a9c5fa85785810d521f4e09a05b196d
SHA256

3850c3fb21ba8fbcc137ca61a87877e5b05eebc204cd1ccafd03fab0928de7e8
SHA512

e79167363f8967c1ad88a482847afbc54924977afa2b19472e8f85da5aedfa234b44e599717dc20b9dd9a157c48f0ff9e8d2fa130822368e9e5379d9d4099434
SSDEEP

192:bONbedw+lJ5mKR/SR4WdFqupxj1G3kc40+nAbKoJ6fWWmngWj/SCgR3:bONbedw+lJ5rDUv7BDCe3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	2384	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2680	2384	AcroRd32.exe	30
PID 2384 wrote to memory of 2680	2384	AcroRd32.exe	30
PID 2384 wrote to memory of 2680	2384	AcroRd32.exe	30
PID 2384 wrote to memory of 2680	2384	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4a0ffa7638a53a4d6a51288acadcce11_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 760
  2⤵
  - Program crash
  PID:2680

memory/2384-0-0x0000000003020000-0x0000000003096000-memory.dmp

Filesize
472KB

Download