e571cd3a4c0744cb3c5443b868577adced331a7545fcb6e2ed0efbe7506a2f9b

Analysis

Target
fiashplayerpp_lnstall_cn.exe
Size 1.6MB
Sample200827-psevvsdsre
SHA256 e571cd3a4c0744cb3c5443b868577adced331a7545fcb6e2ed0efbe7506a2f9b
MD5 24d9aedfbf8e7841716d307177bd5fe4
SHA1 6a11b5a71781410cf2fe48262beac581caf9c723
SHA512 b2b783411e4575cc51841524e3a209b46b9b5c215be4ad640aea418a2837b8538f23845417820c4a47d652694a4435082ba290ce43351871e8db8dedd43ea08e
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
3756	flash.exe
3852	flashplayerpp_lnstall_cn.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3852	flashplayerpp_lnstall_cn.exe
3852	flashplayerpp_lnstall_cn.exe
3852	flashplayerpp_lnstall_cn.exe
3852	flashplayerpp_lnstall_cn.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 3756	3832	fiashplayerpp_lnstall_cn.exe	67
PID 3832 wrote to memory of 3756	3832	fiashplayerpp_lnstall_cn.exe	67
PID 3832 wrote to memory of 3756	3832	fiashplayerpp_lnstall_cn.exe	67
PID 3832 wrote to memory of 3852	3832	fiashplayerpp_lnstall_cn.exe	69
PID 3832 wrote to memory of 3852	3832	fiashplayerpp_lnstall_cn.exe	69
PID 3832 wrote to memory of 3852	3832	fiashplayerpp_lnstall_cn.exe	69

C:\Users\Admin\AppData\Local\Temp\fiashplayerpp_lnstall_cn.exe
"C:\Users\Admin\AppData\Local\Temp\fiashplayerpp_lnstall_cn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\windows\temp\flash.exe
  "C:\windows\temp\flash.exe"
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\windows\temp\flashplayerpp_lnstall_cn.exe
  "C:\windows\temp\flashplayerpp_lnstall_cn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3852

memory/3756-8-0x0000000000650000-0x0000000000683000-memory.dmp

Download