b97e67fd7ba7bd72f72ca66b21dfe026c9f379fd8c36478e3ac34a48d9cd86b8

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 17:44

Target

8cf3558fdb2a440d596faabd4e39fe8a.pdf
Size

112KB
MD5

8cf3558fdb2a440d596faabd4e39fe8a
SHA1

4410e12aa152636176b58a8e9916feb90027f5ff
SHA256

b97e67fd7ba7bd72f72ca66b21dfe026c9f379fd8c36478e3ac34a48d9cd86b8
SHA512

34c71f24129b3db63a5987e550ade37471f48af85b883caa102c5267c3ffd7ec93e5a6b5726c20c2565e2575dc3122fe3c12925d09fd254714f8b6f6639e9963
SSDEEP

768:ZePWZSVsV1YPveYmYGbLB/vbQNK775BoQ4mijVJipEhiD6T+bIxp0sO9PGVigGZw:a

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2872	2512	AcroRd32.exe	28
PID 2512 wrote to memory of 2872	2512	AcroRd32.exe	28
PID 2512 wrote to memory of 2872	2512	AcroRd32.exe	28
PID 2512 wrote to memory of 2872	2512	AcroRd32.exe	28
PID 2512 wrote to memory of 2872	2512	AcroRd32.exe	28
PID 2512 wrote to memory of 2872	2512	AcroRd32.exe	28
PID 2512 wrote to memory of 2872	2512	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8cf3558fdb2a440d596faabd4e39fe8a.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 -s C:\Users\Admin\AppData\Local\Temp\wpbt0.dll
  2⤵
  PID:2872

C:\Users\Admin\AppData\Local\Temp\wpbt0.dll

Filesize
1KB

MD5
67ac7bffbf147781312409d692b5012a

SHA1
bd2a0b220347347a419e5cab67d65147ac8871c3

SHA256
0150ab72f55e5d549d46931e87e5969e34bac62d8a754b3e5ccc50fc621f743e

SHA512
4031e2f8ac2155d22301349f4687e99e92773927b72a739bce320a4dfcd32120f216bbe1f123b7cbba26d9adbf7ed67311f276c5066092d139cd7d15db46e647

Download Submit
memory/2512-0-0x0000000002FD0000-0x0000000003046000-memory.dmp

Filesize
472KB

Download
memory/2512-3-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2512-4-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download