1e2ced0bf97c8caa6021784418f2edba1d0e618034fa15d83a0e8896e0936993

Analysis

Target
Document pdf.exe
Size 142KB
Sample201012-ccfnl7d4m6
SHA256 1e2ced0bf97c8caa6021784418f2edba1d0e618034fa15d83a0e8896e0936993
MD5 183fa6cbd9709e563c3685fdcf7f0bfa
SHA1 c35f78805020632db529dcab134d7b383d29d4d4
SHA512 d7a557a7ca0c15acc86e2930b1f6b57048f2e95754d66a46d5339ec03bc98d663cb28e28093bc5af7d898d9c2d413f9a12a7d9781a8f3824f5e6e0592d8860ff
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3940	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	Document pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3940	2096	Document pdf.exe	72
PID 2096 wrote to memory of 3940	2096	Document pdf.exe	72
PID 2096 wrote to memory of 3940	2096	Document pdf.exe	72

C:\Users\Admin\AppData\Local\Temp\Document pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Document pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:3940

memory/2096-0-0x0000000073380000-0x0000000073A6E000-memory.dmp

Download

memory/2096-1-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/2096-2-0x00000000053E0000-0x00000000053E1000-memory.dmp

Download

memory/2096-3-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/2096-4-0x0000000004F80000-0x0000000004F81000-memory.dmp

Download

memory/2096-5-0x0000000007310000-0x0000000007311000-memory.dmp

Download