fbaa4c2dceaea4dc76e9ed3a24563ccebe4fd783748e48ed6dc729b7f49f46c4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 07:57

Target

5fa7e04d0a016bb6e6dd674a1df90d13_JaffaCakes118.pdf
Size

12KB
MD5

5fa7e04d0a016bb6e6dd674a1df90d13
SHA1

a4626b0bd409a91c3d732da01be9487b281ca5a6
SHA256

fbaa4c2dceaea4dc76e9ed3a24563ccebe4fd783748e48ed6dc729b7f49f46c4
SHA512

673ca46252f8be5614439541433054b29f64de6cd1189cfa1d2f95c1391d9dbef61a3b0366952114447386f3b8a54a553adf4960cdf3b82dc30cc138266559a2
SSDEEP

384:bONbedw+lJ5bZ+mmxmm6mmZm/mmCmm88WmmHKVmub+jZgPt7RmmGWmmm1mmmFo9g:NYgdGsUODpXfJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2224	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2996	2224	AcroRd32.exe	30
PID 2224 wrote to memory of 2996	2224	AcroRd32.exe	30
PID 2224 wrote to memory of 2996	2224	AcroRd32.exe	30
PID 2224 wrote to memory of 2996	2224	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5fa7e04d0a016bb6e6dd674a1df90d13_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 752
  2⤵
  - Program crash
  PID:2996

memory/2224-0-0x0000000003DD0000-0x0000000003E46000-memory.dmp

Filesize
472KB

Download