2f7c40836d06837ca895e5f52c187fd40a55eb8e1c82b89eb9a90d9515aa4302

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 08:09

Target

5fb11a3e5c3159f1f1f874369ca8d6cc_JaffaCakes118.pdf
Size

132KB
MD5

5fb11a3e5c3159f1f1f874369ca8d6cc
SHA1

4856b786810a8f529826ddc4dd3d19ed05ce4cb2
SHA256

2f7c40836d06837ca895e5f52c187fd40a55eb8e1c82b89eb9a90d9515aa4302
SHA512

8e3f1d8e2f17a16b08a1bf0154ad880d01f320fc1a36c817aeb47499f9b80c243b25442ace2ec9a41b18b237888adfc41c17c2ab004b200a09922dfaac71b07b
SSDEEP

768:He7JyiY9l83yPYb+Svnv7lf6EzPXfRbMvDgfVoIBXvhPKBDZfHmKcuPr38TQr4uL:L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	2564	WerFault.exe	30

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2052	2564	AcroRd32.exe	31
PID 2564 wrote to memory of 2052	2564	AcroRd32.exe	31
PID 2564 wrote to memory of 2052	2564	AcroRd32.exe	31
PID 2564 wrote to memory of 2052	2564	AcroRd32.exe	31

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5fb11a3e5c3159f1f1f874369ca8d6cc_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 752
  2⤵
  - Program crash
  PID:2052

memory/2564-0-0x00000000038A0000-0x0000000003916000-memory.dmp

Filesize
472KB

Download