6b6608eb7f4771d86ac6781ce872045a697c2e36161a66cb5a9f2b1207f29b44

Analysis

max time kernel
17s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:17

Target

4ad845e944a28d783d7b669577d46336_JaffaCakes118.pdf
Size

83KB
MD5

4ad845e944a28d783d7b669577d46336
SHA1

f0d3438431f799038f989929bc78f63caa36e1c1
SHA256

6b6608eb7f4771d86ac6781ce872045a697c2e36161a66cb5a9f2b1207f29b44
SHA512

ab2d57ac06a10e9cb03a8837d27564a5bc468fa206a82441a5165bf524eac99539dd9ee98c5d9b867c41c7e4ed17ead49b87f6de030552281e4b2085a87dd5ff
SSDEEP

192:bONbedw+lJ5W65tEmIN9II29AIDIpIUbm9otZ3:bONbedw+lJ5W65tEmIYIVIDIpIUbvD3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	1732	WerFault.exe	28

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 812	1732	AcroRd32.exe	29
PID 1732 wrote to memory of 812	1732	AcroRd32.exe	29
PID 1732 wrote to memory of 812	1732	AcroRd32.exe	29
PID 1732 wrote to memory of 812	1732	AcroRd32.exe	29

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4ad845e944a28d783d7b669577d46336_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 752
  2⤵
  - Program crash
  PID:812

memory/1732-0-0x0000000003110000-0x0000000003186000-memory.dmp

Filesize
472KB

Download