1ad2fd9d3b6631553ce4da5395d615b02a438215c1f0416dd7815dffb5bb1e4f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 05:42

Target

6658dffe05fa248fcbf3509c57ff8649_JaffaCakes118.pdf
Size

60KB
MD5

6658dffe05fa248fcbf3509c57ff8649
SHA1

717b27b541d109aeba0449c87bf7aa7e354f39c2
SHA256

1ad2fd9d3b6631553ce4da5395d615b02a438215c1f0416dd7815dffb5bb1e4f
SHA512

f7ae09cd337e27bf7caa6a5e90cabc9e7043cee86a44636d918db86a490443b0ca8adb605b796662a94b489ef527952ad90655e5f2b5bd541f4a1717a5e54245
SSDEEP

384:bONbedw+DJ5LOXtwaX5LYPOi4hxdbBimPJ017ZlW+X/hEkgXf2EDEPj4iNlQoqqV:1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2568	3040	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2568	3040	AcroRd32.exe	30
PID 3040 wrote to memory of 2568	3040	AcroRd32.exe	30
PID 3040 wrote to memory of 2568	3040	AcroRd32.exe	30
PID 3040 wrote to memory of 2568	3040	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6658dffe05fa248fcbf3509c57ff8649_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 756
  2⤵
  - Program crash
  PID:2568

memory/3040-0-0x0000000004000000-0x0000000004076000-memory.dmp

Filesize
472KB

Download