48f13cab735acfad6232662439ac62e905be955184074821360615a382f9ad6e

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 20:12

Target

64a3857a5371f379d7b5abdf5e26949e_JaffaCakes118.pdf
Size

60KB
MD5

64a3857a5371f379d7b5abdf5e26949e
SHA1

fb97480344c7c115c9f901c4b5c46dce97e271d1
SHA256

48f13cab735acfad6232662439ac62e905be955184074821360615a382f9ad6e
SHA512

cbbe9e0bb83f309635557a76626e7f856276426a409474ed7e3e4f6113ca67635d9dcdaa1cc0b7e025f70c6a76ecc3f24867fb659cfb05ca423fe24fb9c74313
SSDEEP

384:bONbedw+DJ5r8Fg49eWYVnyGViqlA450d9+JFfiF6Fc4aYVnvxsgZBTmtK/Xo8bi:0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	2444	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2360	2444	AcroRd32.exe	28
PID 2444 wrote to memory of 2360	2444	AcroRd32.exe	28
PID 2444 wrote to memory of 2360	2444	AcroRd32.exe	28
PID 2444 wrote to memory of 2360	2444	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\64a3857a5371f379d7b5abdf5e26949e_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 764
  2⤵
  - Program crash
  PID:2360

memory/2444-0-0x00000000035C0000-0x0000000003636000-memory.dmp

Filesize
472KB

Download