FlashPlayerInstaller reading LSASS memory

Forum|Forum|7 years ago
December 6, 2018
5 replies
4789 views

Hello,

The recent flash update appeared with a weird process chain in our antivirus, it shows the initial signed installer calling an unsigned install which then scrapes LSASS memory. Is this normally the process that Flash should be installing with?

The antivirus shows the execution chain as:

CMD: FlashPlayerInstaller.exe -install -iv 9 VirusTotal

CMD: "C:\WINDOWS\system32\Macromed\Temp\{ED9F96DB-0F7C-4FE6-8D3E-DC481E02E23A}\InstallFlashPla yer.exe" -install -skipARPEntry -iv 9 -au 4294967295

VirusTotal (unsigned)

Reads LSASS memory VirusTotal

Thanks!

Download install

This topic has been closed for replies.

Garr_Woof

Participant

I would like some actually responsible person from Adobe answer this question:

Are ALL official updates from Adobe Flashplayer supposed to be SIGNED ? By some CERT Organization?

Or is this an utterly useless thing that every hacker knows how to fake?

Either way, I see some unsigned updates on my computer, and I wonder whether they ought to be deleted.

Likewise, I also wonder why either Malwarebytes or Avast Internet Security does not issue warnings about

unsigned updates from Adobe Flash.

The whole website of Adobe.com does not show a single article about this. So, I ask again: Is there a single

responsible person working at Adobe.com?

nolsen311

Participant

Here's a fun thread on an earlier version where the advice is that VirusTotal has all the answer and this **must** be a False Positive, rather than an unecessary read of protected memory.

https://community.adobe.com/t5/flash-player/flashplayer-27-0-0-183-exe-installer-trying-to-access-lsass-exe/m-p/10878479#M205620

A

Anonymous

Изминить настройки региона попробу, а так же конфидециальность.

Походу запладка как на win xp msblast.

Уровень защиты измени

nolsen311

Participant

Is there seriously no public answer to this question?

I am getting so tired of community forums where common questions are answered "out of band".