207c08a612fc9722c954bc917fe41f4c65d09649808d605c8ef5dc1b35fe9706

Analysis

max time kernel
133s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 16:37

Target

b7dfaca040224d2e8139246b509969ee.pdf
Size

112KB
MD5

b7dfaca040224d2e8139246b509969ee
SHA1

793635603a53a04316ebd4ad5b1ff8d149aaa6ab
SHA256

207c08a612fc9722c954bc917fe41f4c65d09649808d605c8ef5dc1b35fe9706
SHA512

2952f12ef582481d6e8ce6eda8c4e4f870cb96835476df8c902c69f0b41e567a97b8b8456a82da7064ced29b1ac71bb2fb8ee7d347de8527f94a2c1876eebbdc
SSDEEP

768:DMVWZSVsV1YPveYmYGbLB/vbQNK775BoQ4mijVJipEhiD6T+bIxp0sO9PGVigGZw:4

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2484	2972	AcroRd32.exe	28
PID 2972 wrote to memory of 2484	2972	AcroRd32.exe	28
PID 2972 wrote to memory of 2484	2972	AcroRd32.exe	28
PID 2972 wrote to memory of 2484	2972	AcroRd32.exe	28
PID 2972 wrote to memory of 2484	2972	AcroRd32.exe	28
PID 2972 wrote to memory of 2484	2972	AcroRd32.exe	28
PID 2972 wrote to memory of 2484	2972	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b7dfaca040224d2e8139246b509969ee.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 -s C:\Users\Admin\AppData\Local\Temp\wpbt0.dll
  2⤵
  PID:2484

C:\Users\Admin\AppData\Local\Temp\wpbt0.dll

Filesize
22KB

MD5
6911c99679e72b4b1ccbec237c83f2f7

SHA1
5713415dcf5d66b56a023cb5fdad313249854b93

SHA256
21deaaa3354f46038c08703cb8063d906d17133e497a90c6b09f057fa9179e69

SHA512
284e3a118c2ac64ea35f4d04dd033b021ff7d52ae15c3e292331bb7db19a2906e8e4ba615092501e2dfa657f3d478a07ef37504f3d097fc89b9197387be7608f

Download Submit
memory/2972-0-0x0000000002E40000-0x0000000002EB6000-memory.dmp

Filesize
472KB

Download
memory/2972-3-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/2972-4-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download