d38147f0a80e382ede21d949b566b2aa7b131db012489c3c234c9fa1c16b713d

Analysis

max time kernel
121s
max time network
166s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:34

Target

21e3ab1d7163f117c68ad611fb338dd6.pdf
Size

112KB
MD5

21e3ab1d7163f117c68ad611fb338dd6
SHA1

e3e8d2a4e17483f00cd4baf71b9f9ab5d16aefc5
SHA256

d38147f0a80e382ede21d949b566b2aa7b131db012489c3c234c9fa1c16b713d
SHA512

8d772130394b06e2f6b6c9d854aff37aa3dad8b67aac9f85f9b5ddbd14ec9d79abc7b4bcfba6156a81f6c92a37f074be8356f5304b42facead8938251ed69e97
SSDEEP

768:ZAFWZSVsV1YPveYmYGbLB/vbQNK775BoQ4mijVJipEhiD6T+bIxp0sO9PGVigGZw:W

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2576	1192	AcroRd32.exe	29
PID 1192 wrote to memory of 2576	1192	AcroRd32.exe	29
PID 1192 wrote to memory of 2576	1192	AcroRd32.exe	29
PID 1192 wrote to memory of 2576	1192	AcroRd32.exe	29
PID 1192 wrote to memory of 2576	1192	AcroRd32.exe	29
PID 1192 wrote to memory of 2576	1192	AcroRd32.exe	29
PID 1192 wrote to memory of 2576	1192	AcroRd32.exe	29

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\21e3ab1d7163f117c68ad611fb338dd6.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 -s C:\Users\Admin\AppData\Local\Temp\wpbt0.dll
  2⤵
  PID:2576

C:\Users\Admin\AppData\Local\Temp\wpbt0.dll

Filesize
1KB

MD5
41350ec76a3b767809ca77536c76949f

SHA1
b5e31ba749f5211f4d30c364c6d22cac9be4b71d

SHA256
e892c853c3d6b52d73b490569b6a3a47a20e0db8464bf489648c53463e36c473

SHA512
f06c6bd772c51e66d65b0eb37597731b0992dc97a8412c1dd0b3b5ae11868e6817662ab13c90f24a35049a962fcb6b34b8f11ce788dca882965996f8b5045c69

Download Submit
memory/1192-0-0x0000000003BE0000-0x0000000003C56000-memory.dmp

Filesize
472KB

Download
memory/1192-3-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/1192-4-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download