Analysis
-
max time kernel
60s -
max time network
60s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 13:55
General
-
Target
PO_610.20-21.A2424.UP_PDF.exe
-
Size
297KB
-
MD5
3ea0aeab9cc01933b5ba3f78e8ceddb4
-
SHA1
ecd362b4af516f2855607326ffcf684355ec4762
-
SHA256
feb7ef6e6c842b97b92c82fdba89499c252cc9414874efc7fafae8389dbf0538
-
SHA512
455f749c00be8dc2108c60f18efd5217b5eb2bf7414871ad82c50a84419d04934702893e90f95adfbcde89bf677c0d78cb636b86670192179327da2ac13d2170
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_610.20-21.A2424.UP_PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO_610.20-21.A2424.UP_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_610.20-21.A2424.UP_PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO_610.20-21.A2424.UP_PDF.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
8KB
-
Filesize
68KB
-
Filesize
4KB