b900599a9c8b0fbbb1432d43c9eaf5a23e629980484874efbae8f174dbefffbb

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 18:31

Target

4ae348432e24720f1013eba84e2e45cd_JaffaCakes118.pdf
Size

12KB
MD5

4ae348432e24720f1013eba84e2e45cd
SHA1

00adaee18f4e4547f8a3927785eb1ddf5bd6b6fd
SHA256

b900599a9c8b0fbbb1432d43c9eaf5a23e629980484874efbae8f174dbefffbb
SHA512

b45a6d507b15caa8fe8e5c893dfbcd1cf204e6878277a9f835438e14543d6aa5b088e1836ac724361e912501248d5889afc010b63da67ff680e13f9b3bc236c6
SSDEEP

384:bONbedw+lJ5fwJNZ23KLQ7Rret5zroFdARp53e3:023KLQ7Rret5zrofARp53S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	2828	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2780	2828	AcroRd32.exe	30
PID 2828 wrote to memory of 2780	2828	AcroRd32.exe	30
PID 2828 wrote to memory of 2780	2828	AcroRd32.exe	30
PID 2828 wrote to memory of 2780	2828	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4ae348432e24720f1013eba84e2e45cd_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 752
  2⤵
  - Program crash
  PID:2780

memory/2828-0-0x0000000002FE0000-0x0000000003056000-memory.dmp

Filesize
472KB

Download