19c9c1c31c0c1c7e4f40704485390d6a26ca01cae959f418219579d372351c6e

Analysis

max time kernel
10s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 21:26

Target

5dbb0d7fc039bb578a2cda10d8d918f5_JaffaCakes118.pdf
Size

61KB
MD5

5dbb0d7fc039bb578a2cda10d8d918f5
SHA1

2422aa7aa6e69c3b47d4906d5945f1620a558c0b
SHA256

19c9c1c31c0c1c7e4f40704485390d6a26ca01cae959f418219579d372351c6e
SHA512

2e16b81dfabbdf3314bbd42536cd4de1567c05235bb1c0966903190d9259aa770cd39fc89c0f03872cacfd7ea0f49959e2582ada61a19703919082ea2dcbf892
SSDEEP

192:bONbedw+DJ5X+dXg+yt00VrPPX/f+KEidis3Bxv5RpyDMDx1Kz8CpGdWlHfT33Pj:bONbedw+DJ5W1zlTVZ3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	2520	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2008	2520	AcroRd32.exe	30
PID 2520 wrote to memory of 2008	2520	AcroRd32.exe	30
PID 2520 wrote to memory of 2008	2520	AcroRd32.exe	30
PID 2520 wrote to memory of 2008	2520	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5dbb0d7fc039bb578a2cda10d8d918f5_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 756
  2⤵
  - Program crash
  PID:2008

memory/2520-0-0x0000000002CD0000-0x0000000002D46000-memory.dmp

Filesize
472KB

Download