c38f77feb45db3fdd9fd71d10caf476f08f2ae31bfb40664fcce71b70ff13fdb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 14:29

Target

5c557cb06f2543687c4ac4ed1347dfdd_JaffaCakes118.pdf
Size

16KB
MD5

5c557cb06f2543687c4ac4ed1347dfdd
SHA1

6eb83f87f482c113ed25e967cbfedd5e07472b39
SHA256

c38f77feb45db3fdd9fd71d10caf476f08f2ae31bfb40664fcce71b70ff13fdb
SHA512

60286190b82d2aa69533522d62be4e5198deb4a4850168b509675279d51a9717aaaa2d11a047991fc0cdcb17c3836816ab9e59287b7edd1ffec08671b57522ec
SSDEEP

192:4ONyCeewIjJizuqwgezrzlhDjdjE0oW9zVArr3Ogt1v:4ONyCeewIjJiz2gezvdI0oUzQrX7v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	3028	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2900	3028	AcroRd32.exe	30
PID 3028 wrote to memory of 2900	3028	AcroRd32.exe	30
PID 3028 wrote to memory of 2900	3028	AcroRd32.exe	30
PID 3028 wrote to memory of 2900	3028	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5c557cb06f2543687c4ac4ed1347dfdd_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 760
  2⤵
  - Program crash
  PID:2900

memory/3028-0-0x0000000003130000-0x00000000031A6000-memory.dmp

Filesize
472KB

Download