9dc7ed8e10c06b2e132abbafe3ecdbfdfa258c86284d3aee015dc21695dc301a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 18:28

Target

60f2953dc72a711d267179160a45e1af_JaffaCakes118.pdf
Size

89KB
MD5

60f2953dc72a711d267179160a45e1af
SHA1

42779c82ed0434372a16b2a35a1a8dead3778bd7
SHA256

9dc7ed8e10c06b2e132abbafe3ecdbfdfa258c86284d3aee015dc21695dc301a
SHA512

5ccc6bc17596cd712243e49686cb00ef90ee7a3c713860783084f91cec645c93085c0829c00cca12fd68aa012ba728452123184c52e54a91d5d432a67b02d9b2
SSDEEP

384:bONbedw+lJ5lwmpLpxX7n0XbDJzmfqjb0UsdGoQqXNsKyMDNn9280+i0gjHGZ2NK:/wNcZ0OFB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	824	WerFault.exe	30

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2780	824	AcroRd32.exe	31
PID 824 wrote to memory of 2780	824	AcroRd32.exe	31
PID 824 wrote to memory of 2780	824	AcroRd32.exe	31
PID 824 wrote to memory of 2780	824	AcroRd32.exe	31

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\60f2953dc72a711d267179160a45e1af_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 752
  2⤵
  - Program crash
  PID:2780

memory/824-0-0x0000000003610000-0x0000000003686000-memory.dmp

Filesize
472KB

Download