fd1a97e7ece799aa30095b2185f8f907af525701873739baf2221f8fd85231f6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 18:08

Target

60e1d7e654f127b75d72dcc922b0c5ad_JaffaCakes118.pdf
Size

132KB
MD5

60e1d7e654f127b75d72dcc922b0c5ad
SHA1

012601065b36cf4cfece9d8b892f80abf19a6d82
SHA256

fd1a97e7ece799aa30095b2185f8f907af525701873739baf2221f8fd85231f6
SHA512

105704a39dabbe7dd1fc45b219726c3b89733d4a1bd197a0116852d314db879d9c463dc910806ed1b7adb1b86c8a91b263bca1c0470903422ab081204ba04f6f
SSDEEP

192:bONbedw+lJ5SsbLHGpNXIeIICY2/stDSMpXCeg9rCuEtDzCgOEtSrMpc9ADGr9uY:bONbedw+lJ5xCe73

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	900	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2892	900	AcroRd32.exe	30
PID 900 wrote to memory of 2892	900	AcroRd32.exe	30
PID 900 wrote to memory of 2892	900	AcroRd32.exe	30
PID 900 wrote to memory of 2892	900	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\60e1d7e654f127b75d72dcc922b0c5ad_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 752
  2⤵
  - Program crash
  PID:2892

memory/900-0-0x0000000002C50000-0x0000000002CC6000-memory.dmp

Filesize
472KB

Download