2f8daf0f7d0ba0b573b93f3e4ffb75e157a0e78be8a07bde8325dbd0efe42b6b

Analysis

Target
20200715 Raaziq International Pvt Ltd.pdf.exe
Size 575KB
Sample201014-njstqkbwpn
SHA256 2f8daf0f7d0ba0b573b93f3e4ffb75e157a0e78be8a07bde8325dbd0efe42b6b
MD5 5660db9547062891e7d36558f435be50
SHA1 15af7203d4f37d121a55745df838965560bdab8b
SHA512 a5a9cb1e7067c3c735796a76f45d3af1b678dde6528734f47559a39fd70ef151605bd89b2b2bc983533d6f1a83feb6c7b6245ca6a6e4b526225dcd3912214bb5
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3888	dw20.exe
3888	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3888	dw20.exe
Token: SeBackupPrivilege	3888	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3888	3952	20200715 Raaziq International Pvt Ltd.pdf.exe	75
PID 3952 wrote to memory of 3888	3952	20200715 Raaziq International Pvt Ltd.pdf.exe	75
PID 3952 wrote to memory of 3888	3952	20200715 Raaziq International Pvt Ltd.pdf.exe	75

C:\Users\Admin\AppData\Local\Temp\20200715 Raaziq International Pvt Ltd.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\20200715 Raaziq International Pvt Ltd.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 856
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3888

memory/3888-1-0x0000000002930000-0x0000000002931000-memory.dmp

Download

memory/3888-2-0x0000000002D50000-0x0000000002D51000-memory.dmp

Download

memory/3888-4-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download