412b7d4cb07062f6dfde736bae8c5cbd2c2e1c6bdb4c179e377ef2e494c670c2

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 08:17

Target

66ccb4f3ceb0562716b98cbca7df3c77_JaffaCakes118.pdf
Size

12KB
MD5

66ccb4f3ceb0562716b98cbca7df3c77
SHA1

cae5414c293335182fda11b36cb25c12365cdba5
SHA256

412b7d4cb07062f6dfde736bae8c5cbd2c2e1c6bdb4c179e377ef2e494c670c2
SHA512

f2bf2bde5d2dca75ef5989c54b442b6d9a1403195af8feacb347a96907ae38f2dcb530b636685b8f8d3278b7399d2828d9e3f9c1d3cea6ac1faa31bc7bc70341
SSDEEP

384:bONbedw+lJ5ozqMXb41Nrda7jMWOyQ9aeG/u2kKw7Uaj3:+zqQb41Npa7jMWOyQ9aeG/u2kjUaj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	2212	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2820	2212	AcroRd32.exe	30
PID 2212 wrote to memory of 2820	2212	AcroRd32.exe	30
PID 2212 wrote to memory of 2820	2212	AcroRd32.exe	30
PID 2212 wrote to memory of 2820	2212	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\66ccb4f3ceb0562716b98cbca7df3c77_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 752
  2⤵
  - Program crash
  PID:2820

memory/2212-0-0x0000000002D90000-0x0000000002E06000-memory.dmp

Filesize
472KB

Download