d2669f09cb9d457a0bb1ebc7db59cc0f53778ebf2fbd90f84b7c3fd587a109bb

Analysis

Target
Wire Confirmation_pdf.exe
Size 92KB
Sample201109-d9ga8wj7ea
SHA256 d2669f09cb9d457a0bb1ebc7db59cc0f53778ebf2fbd90f84b7c3fd587a109bb
MD5 341d586e5c01e7bac68d1b41711bccab
SHA1 0138832da5dba5c4759760a3026f9da0af157b66
SHA512 16da0f22d0ad16f7506cdbbb12deb08d59b9fa4dc472504717ef67bee3f18ba28cd125b138d4a410f24ef407667871e99d6f19c4a0354682c702d1da57dce67e
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4768	Wire Confirmation_pdf.exe
4184	Wire Confirmation_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 4184	4768	Wire Confirmation_pdf.exe	78

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4768	Wire Confirmation_pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4768	Wire Confirmation_pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4184	4768	Wire Confirmation_pdf.exe	78
PID 4768 wrote to memory of 4184	4768	Wire Confirmation_pdf.exe	78
PID 4768 wrote to memory of 4184	4768	Wire Confirmation_pdf.exe	78
PID 4768 wrote to memory of 4184	4768	Wire Confirmation_pdf.exe	78

C:\Users\Admin\AppData\Local\Temp\Wire Confirmation_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Wire Confirmation_pdf.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\Wire Confirmation_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Wire Confirmation_pdf.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4184