0d25ba56dd12d0ea88086dd34ce1194be7f4affb2425d597b0e0023ce2929ab4 | Triage

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 11:49

Sharing

Report Analysis Logs

General

Target

PPT/Writing_Language_LYL.pdf
Size

1.7MB
MD5

2482b1d078043a279bc8916c55e17745
SHA1

3a20712e33affa12acbe692f32d4e54932cde580
SHA256

ec2a47d5ab26532d959ab6e742cf6935c573ffdf044969c2a2fbc746190ff09d
SHA512

0426c1c2c7f084b88b48addd7a1038d40a280591814b0d51d7e1be0c4e7096d6d06993b70d5372710d31be626e17074d7108d0004c47295c9037853efd53e367
SSDEEP

24576:usEb1dnGJuXn6QwVMvgxyhZgTzanRsn0vbaO0ruD:u9n6QwSY1SFv0KD

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1460 AcroRd32.exe
1460 AcroRd32.exe
1460 AcroRd32.exe
1460 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PPT\Writing_Language_LYL.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1460

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download