ded1a64ebd165901f2a790ab8d7fd0aa3ae2f97738868d2d1add45e033efe738

Analysis

Target
Account TT_pdf.exe
Size 64KB
Sample201109-tkxf73dlcs
SHA256 ded1a64ebd165901f2a790ab8d7fd0aa3ae2f97738868d2d1add45e033efe738
MD5 5acf4f5cd6f07a74c0ba5a7f156c70d5
SHA1 417895ca2899fda56e3f36d35b578d1622405145
SHA512 9462a6c697124267ae555b88045726d1ea2f2a4fe7ac24c53b19a4cdad6e8790e2987e12e5b62e1672885cec3117c4877627c98c370655cc253ab3af2898e0cc
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
484	Account TT_pdf.exe
316	Account TT_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 484 set thread context of 316	484	Account TT_pdf.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
484	Account TT_pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
484	Account TT_pdf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 316	484	Account TT_pdf.exe	29
PID 484 wrote to memory of 316	484	Account TT_pdf.exe	29
PID 484 wrote to memory of 316	484	Account TT_pdf.exe	29
PID 484 wrote to memory of 316	484	Account TT_pdf.exe	29
PID 484 wrote to memory of 316	484	Account TT_pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\Account TT_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Account TT_pdf.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484
- C:\Users\Admin\AppData\Local\Temp\Account TT_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Account TT_pdf.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:316