378911a0ffd090bc26b1bb981abe1c5bb8dec098e3138ef0b9a7f1ce88747fbd

Analysis

Target
FEDEX CONFIRMATION - 0987847_Pdf.exe
Size 370KB
Sample201015-eeap3pt2vj
SHA256 378911a0ffd090bc26b1bb981abe1c5bb8dec098e3138ef0b9a7f1ce88747fbd
MD5 61c84a897ecc15ffc58f40624dce7f94
SHA1 432b4ee02e8bbaee2f8bc41f1effb0567b3fcbee
SHA512 2edf61f0799bba0b99652231a79304136f87e2818b91636a18eb266ee30a73e2da79bab28f5c2bd5daf14b5501e56948d1097a7235aec34dc488b5b7ba5d81da
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1904	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	FEDEX CONFIRMATION - 0987847_Pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1904	1680	FEDEX CONFIRMATION - 0987847_Pdf.exe	25
PID 1680 wrote to memory of 1904	1680	FEDEX CONFIRMATION - 0987847_Pdf.exe	25
PID 1680 wrote to memory of 1904	1680	FEDEX CONFIRMATION - 0987847_Pdf.exe	25
PID 1680 wrote to memory of 1904	1680	FEDEX CONFIRMATION - 0987847_Pdf.exe	25

C:\Users\Admin\AppData\Local\Temp\FEDEX CONFIRMATION - 0987847_Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\FEDEX CONFIRMATION - 0987847_Pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:1904

memory/1680-0-0x0000000073D80000-0x000000007446E000-memory.dmp

Download

memory/1680-1-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download