File name: | RdrServicesUpdater2_x86.exe |
Full analysis: | https://app.any.run/tasks/cc5f2a7a-257e-4446-a133-6e6f7e961db8 |
Verdict: | Malicious activity |
Analysis date: | December 29, 2023, 10:13:26 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (console) Intel 80386, for MS Windows |
MD5: | 24F8D57B669F33FCB30D8FB045B27F8D |
SHA1: | AF5CE95626911FE8954718B6B4897FAF2E8F201F |
SHA256: | 947B2D0490101A8BF8FB7AACA36289F11D15BED605EFD46BFD45298CCCFB375B |
SSDEEP: | 1536:TD09r2/l1xkbstUQtU74MzhuxPufENh1SaJx:0p2/fxBtnLPufkBJx |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
Subsystem: | Windows command line |
---|---|
SubsystemVersion: | 6 |
ImageVersion: | - |
OSVersion: | 6 |
EntryPoint: | 0x7ab4 |
UninitializedDataSize: | - |
InitializedDataSize: | 31232 |
CodeSize: | 31232 |
LinkerVersion: | 14.28 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2023:11:07 14:55:19+01:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2124 | "C:\Users\admin\Desktop\RdrServicesUpdater2_x86.exe" | C:\Users\admin\Desktop\RdrServicesUpdater2_x86.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
324 | "C:\Users\admin\Desktop\RdrServicesUpdater2_x86.exe" | C:\Users\admin\Desktop\RdrServicesUpdater2_x86.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
1840 | "C:\Users\admin\Desktop\RdrServicesUpdater2_x86.exe" | C:\Users\admin\Desktop\RdrServicesUpdater2_x86.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
|
(PID) Process: | (1840) RdrServicesUpdater2_x86.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\Products\{291AA914-A987-4CE9-BD63-AC0A92D435E5} |
Operation: | write | Name: | ProductVersion |
Value: 20.013.20064.0 | |||
(PID) Process: | (1840) RdrServicesUpdater2_x86.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\DC\WebResource |
Operation: | write | Name: | iUpdateId |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2124 | RdrServicesUpdater2_x86.exe | C:\Users\admin\AppData\Local\Temp\ChromeReprompt.txt | binary | |
MD5:EC0B5F2ADFA61A11187B9986B04F688A | SHA256:A115D5B176B67D2B6C689321CF20853061A8A5691821EF6349CD1D1DDE4B357F |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |