21f1369ac1f48a0dfa6e231bf34ac122258517d90f6b8d77d1809f6b7384975c

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 10:09

Target

cb2279c826228ac853ddbbe7966a1e96.pdf
Size

13KB
MD5

cb2279c826228ac853ddbbe7966a1e96
SHA1

3f6c2869e0954bf970c6ffb0ec8b13cb05fdc7cf
SHA256

21f1369ac1f48a0dfa6e231bf34ac122258517d90f6b8d77d1809f6b7384975c
SHA512

cef8f73822e74e93a0e66e5ac344bffe03948c66eb50304c44ad6f46756c49d2f7c597ed5b2ccb90fa785daa8eb0630414b8df9d7fc3eceb44ff6b51c56ae1b5
SSDEEP

192:rQhzajYqwAO9G+/vvTs7hXbfym4GJVbBftJy/suiX9vQNi/60un/T8qvROdjzwu:shzaNwAO9GiM5fdtttdQi/60G78s4djN

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2592	2008	AcroRd32.exe	28
PID 2008 wrote to memory of 2592	2008	AcroRd32.exe	28
PID 2008 wrote to memory of 2592	2008	AcroRd32.exe	28
PID 2008 wrote to memory of 2592	2008	AcroRd32.exe	28
PID 2008 wrote to memory of 2592	2008	AcroRd32.exe	28
PID 2008 wrote to memory of 2592	2008	AcroRd32.exe	28
PID 2008 wrote to memory of 2592	2008	AcroRd32.exe	28

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cb2279c826228ac853ddbbe7966a1e96.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 -s C:\Users\Admin\AppData\Local\Temp\wpbt0.dll
  2⤵
  PID:2592

C:\Users\Admin\AppData\Local\Temp\wpbt0.dll

Filesize
2KB

MD5
99434c502a59da3204039745a0bae9ce

SHA1
5aea4e11a387327795210b5fb938ca6dd150b6af

SHA256
9497ce7fe3373c7e3ec6b3919982e0340a4c7e42a3a5bb9fd88f8a7a5a3b4162

SHA512
5e8c138819e53908943c3d6b5c52871fc9dea16f881e0bec80d13e31ab60f54f1c283ed53532e1673dd2e28ec4e9e6f2e5654d0f52856af74ca0199de9958358

Download Submit
memory/2008-0-0x0000000002D40000-0x0000000002DB6000-memory.dmp

Filesize
472KB

Download
memory/2008-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/2008-4-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download