bf26b74122d2f1a8338716f0190e8c00bd383cdfda7bb1f797a017e244e66352

Analysis

Target

T6636_PDF.exe
Size

1.2MB
MD5

8ff2e665cfb3b37173fa0ad1126d081a
SHA1

624fd5ca214e383b7c210f7792868f022b392260
SHA256

99b3e1c6a5263c2d0b48f0e57ebf750b474ee28a8378af89750e8c154938faf6
SHA512

d423def1ab53669e00234c8b6439d97238d93d638050a1b4fc2d5057b24da6eff768a8ea04127dfa605698e35d565b39b009bae27f35e9cd8eaa3acd836c3e0d

Score

1^/10

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

T6636_PDF.exe

pid process

4208 T6636_PDF.exe
4208 T6636_PDF.exe
4208 T6636_PDF.exe
4208 T6636_PDF.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

T6636_PDF.exe

pid process

4208 T6636_PDF.exe
4208 T6636_PDF.exe
4208 T6636_PDF.exe
4208 T6636_PDF.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

T6636_PDF.exe

description	pid	process	target process
PID 4208 wrote to memory of 4444	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 4444	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 4444	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 4800	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 4800	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 4800	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 4856	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 4856	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 4856	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 1480	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 1480	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 1480	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 3280	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 3280	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 3280	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 1816	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 1816	4208	T6636_PDF.exe	dllhost.exe
PID 4208 wrote to memory of 1816	4208	T6636_PDF.exe	dllhost.exe

memory/1480-133-0x0000000000000000-mapping.dmp

Download
memory/1816-135-0x0000000000000000-mapping.dmp

Download
memory/3280-134-0x0000000000000000-mapping.dmp

Download
memory/4208-136-0x0000000003710000-0x0000000003745000-memory.dmp

Filesize
212KB

Download
memory/4208-137-0x00000000041B0000-0x00000000041E5000-memory.dmp

Filesize
212KB

Download
memory/4444-130-0x0000000000000000-mapping.dmp

Download
memory/4800-131-0x0000000000000000-mapping.dmp

Download
memory/4856-132-0x0000000000000000-mapping.dmp

Download