dc881eab110e70d07d940d3ab0d9aaefbee54f33ef8b0aee216fca637ed94b57

General

Target
doc2019291888001990.pdf.exe
Size 873KB
Sample210908-j81dsshcel
SHA256 dc881eab110e70d07d940d3ab0d9aaefbee54f33ef8b0aee216fca637ed94b57
MD5 314d0ed7c3c63b7b3416e3a3cd0ba6cb
SHA1 f2ed5febe4a422ff9f56f22bf365bfdf13164027
SHA512 7e55b8e4c454ecd3aab598d2a048aa21b1e77ee21640a7b99930c64e1366a495f08942515b925c02b8f3f6e4ebe5eefee1dc1d127546c2838993c166f241a15e
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	doc2019291888001990.pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 584	1260	doc2019291888001990.pdf.exe	30
PID 1260 wrote to memory of 584	1260	doc2019291888001990.pdf.exe	30
PID 1260 wrote to memory of 584	1260	doc2019291888001990.pdf.exe	30
PID 1260 wrote to memory of 584	1260	doc2019291888001990.pdf.exe	30
PID 1260 wrote to memory of 636	1260	doc2019291888001990.pdf.exe	31
PID 1260 wrote to memory of 636	1260	doc2019291888001990.pdf.exe	31
PID 1260 wrote to memory of 636	1260	doc2019291888001990.pdf.exe	31
PID 1260 wrote to memory of 636	1260	doc2019291888001990.pdf.exe	31
PID 1260 wrote to memory of 760	1260	doc2019291888001990.pdf.exe	32
PID 1260 wrote to memory of 760	1260	doc2019291888001990.pdf.exe	32
PID 1260 wrote to memory of 760	1260	doc2019291888001990.pdf.exe	32
PID 1260 wrote to memory of 760	1260	doc2019291888001990.pdf.exe	32
PID 1260 wrote to memory of 868	1260	doc2019291888001990.pdf.exe	33
PID 1260 wrote to memory of 868	1260	doc2019291888001990.pdf.exe	33
PID 1260 wrote to memory of 868	1260	doc2019291888001990.pdf.exe	33
PID 1260 wrote to memory of 868	1260	doc2019291888001990.pdf.exe	33
PID 1260 wrote to memory of 1676	1260	doc2019291888001990.pdf.exe	34
PID 1260 wrote to memory of 1676	1260	doc2019291888001990.pdf.exe	34
PID 1260 wrote to memory of 1676	1260	doc2019291888001990.pdf.exe	34
PID 1260 wrote to memory of 1676	1260	doc2019291888001990.pdf.exe	34

C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe"
  2⤵
  PID:584
- C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe"
  2⤵
  PID:636
- C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe"
  2⤵
  PID:760
- C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe"
  2⤵
  PID:868
- C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\doc2019291888001990.pdf.exe"
  2⤵
  PID:1676

memory/1260-52-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/1260-54-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/1260-55-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/1260-56-0x0000000005270000-0x00000000052D1000-memory.dmp

Download

memory/1260-57-0x00000000008A0000-0x00000000008D8000-memory.dmp

Download