File name: | processhacker-2.39-bin.zip |
Full analysis: | https://app.any.run/tasks/dc6e1160-6bd6-4bc5-a98f-1ae0546eeed1 |
Verdict: | Malicious activity |
Analysis date: | April 25, 2019, 08:56:05 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | B444CF14642CE9B8D75E079166A5DF0B |
SHA1: | 8E8F8423D163D922242B8B7D85427664F77EDC97 |
SHA256: | 2AFB5303E191DDE688C5626C3EE545E32E52F09DA3B35B20F5E0D29A418432F5 |
SSDEEP: | 98304:jDqt5TrOmlLB/7rTOqcXfOzJR1qioDLK2EbhQ:3sTrHlB73OqX4ioDfshQ |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | CHANGELOG.txt |
---|---|
ZipUncompressedSize: | 25995 |
ZipCompressedSize: | 7294 |
ZipCRC: | 0x34beb5ab |
ZipModifyDate: | 2016:03:29 12:18:04 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3008 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\processhacker-2.39-bin.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
596 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
3224 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\processhacker-2.39-bin\x86\kprocesshacker.sys | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3188 | "C:\Users\admin\Desktop\processhacker-2.39-bin\x86\ProcessHacker.exe" | C:\Users\admin\Desktop\processhacker-2.39-bin\x86\ProcessHacker.exe | explorer.exe | |
User: admin Company: wj32 Integrity Level: MEDIUM Description: Process Hacker Exit code: 0 Version: 2.39.0.124 | ||||
3020 | "C:\Users\admin\Desktop\processhacker-2.39-bin\x86\ProcessHacker.exe" -v | C:\Users\admin\Desktop\processhacker-2.39-bin\x86\ProcessHacker.exe | ProcessHacker.exe | |
User: admin Company: wj32 Integrity Level: HIGH Description: Process Hacker Version: 2.39.0.124 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\LICENSE.txt | text | |
MD5:EB59E0A5D01D0A5B02DA0C9E7786969F | SHA256:C38E811F6F83428921D0CECD998A44B717149B577B4C1A63B66064F03C34E4E7 | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\x64\kprocesshacker.sys | executable | |
MD5:1B5C3C458E31BEDE55145D0644E88D75 | SHA256:70211A3F90376BBC61F49C22A63075D1D4DDD53F0AEFA976216C46E6BA39A9F4 | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\CHANGELOG.txt | text | |
MD5:B13DE4E8531AF294F87FFDDCCB08D7CE | SHA256:69E38F590A9A25F656E7507AF76229A3A6678A8C57B4E879FF8CE7E52FD704FF | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\README.txt | text | |
MD5:72AC5A8DD6491E525B9783C9BC439FE6 | SHA256:0C4F051675A690EA4DB6AB2EB81FDCED6990E2538AD21DC4610AA5925253A090 | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\x64\peview.exe | executable | |
MD5:DDE1F44789CD50C1F034042D337DEAE3 | SHA256:4259E53D48A3FED947F561FF04C7F94446BEDD64C87F52400B2CB47A77666AAA | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\x64\plugins\NetworkTools.dll | executable | |
MD5:D6BED1D6FDBED480E32FDD2DD4C13352 | SHA256:476AA6AF14DD0B268786E32543B9A6917A298D4D90E1015DAC6FB2B522CF5D2E | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\x64\plugins\UserNotes.dll | executable | |
MD5:E48C789C425F966F5E5EE3187934174F | SHA256:FC9D0D0482C63AB7F238BC157C3C0FED97951CCF2D2E45BE45C06C426C72CB52 | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\x64\plugins\ExtendedServices.dll | executable | |
MD5:4858BDB7731BF0B46B247A1F01F4A282 | SHA256:5AE7C0972FD4E4C4AE14C0103602CA854377FEFCBCCD86FA68CFC5A6D1F99F60 | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\COPYRIGHT.txt | text | |
MD5:39B07060A5C6199730219E29C747C061 | SHA256:319CD301CF40BE03C00CD086560D4E810E0F6D0DBFDC2D28D6AF3522C027CF49 | |||
3008 | WinRAR.exe | C:\Users\admin\Desktop\processhacker-2.39-bin\x64\ProcessHacker.sig | binary | |
MD5:2CCB4420D40893846E1F88A2E82834DA | SHA256:519C2C2CA0CAF00DB5B3EB2B79DFE42E6128161C13AEB4B4D8B86FBFFC67E3D4 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3188 | ProcessHacker.exe | 162.243.25.33:443 | wj32.org | Digital Ocean, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
wj32.org |
| whitelisted |