a1ade0f4555ea7e2b42da7dbb27d008efe0d1761aff6aa456377597f706dce03

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:25

Target

1a975684ab7047703b47b8663df663d2_JaffaCakes118.pdf
Size

16KB
MD5

1a975684ab7047703b47b8663df663d2
SHA1

7fbfee22184de896b82406f69f167acc920f6a35
SHA256

a1ade0f4555ea7e2b42da7dbb27d008efe0d1761aff6aa456377597f706dce03
SHA512

1e2a48211ff795d1ef9b1372e0e11d7d85cf67eac13dbdd7be1e9ca785d34ba52b838c001ccfdeb625437317402627a38f08322fc642dc6327fa4f18dfeb369b
SSDEEP

384:PZTOoMbclvxVOPmQzUhFR7Ld9jOvATd1h3LAdrFe3D+818JlMlWOwZNpjHHS:PZ6zimPmQzUzR3d9jOW1h3Lp3918Jylb

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2544 832 WerFault.exe AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

832 AcroRd32.exe
832 AcroRd32.exe
832 AcroRd32.exe

pid	pid_target	process	target process
2544	832	WerFault.exe	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

AcroRd32.exe

description	pid	process	target process
PID 832 wrote to memory of 2544	832	AcroRd32.exe	WerFault.exe
PID 832 wrote to memory of 2544	832	AcroRd32.exe	WerFault.exe
PID 832 wrote to memory of 2544	832	AcroRd32.exe	WerFault.exe
PID 832 wrote to memory of 2544	832	AcroRd32.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 760
2⤵
- Program crash
PID:2544