Analysis
-
max time kernel
67s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:40
Static task
static1
Behavioral task
behavioral1
Sample
Scan_DSV_03072020_038465318631_PDF.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Scan_DSV_03072020_038465318631_PDF.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Scan_DSV_03072020_038465318631_PDF.exe
-
Size
820KB
-
MD5
7e3ce66bf8cca74b5a5339d9f2b8aeeb
-
SHA1
5a57f3abe3e6105207ece6f3fd1e830e2c341868
-
SHA256
c4349d30167ec1dfd9c70454c3f91a5ac21d52d433c093391462bc3f995e7781
-
SHA512
5f4bca15864f1d1830e86bd0af9659921ca00178aacc19c9f7dd344a16b5bc77bd067c6c8e3fb3fb4615592ea52de6b981054af24729fe76f79e7db5c4ac23c8
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Scan_DSV_03072020_038465318631_PDF.exepid process 536 Scan_DSV_03072020_038465318631_PDF.exe 536 Scan_DSV_03072020_038465318631_PDF.exe 536 Scan_DSV_03072020_038465318631_PDF.exe 536 Scan_DSV_03072020_038465318631_PDF.exe 536 Scan_DSV_03072020_038465318631_PDF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Scan_DSV_03072020_038465318631_PDF.exedescription pid process Token: SeDebugPrivilege 536 Scan_DSV_03072020_038465318631_PDF.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Scan_DSV_03072020_038465318631_PDF.exedescription pid process target process PID 536 wrote to memory of 1144 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1144 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1144 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1144 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1356 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1356 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1356 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1356 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 816 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 816 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 816 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 816 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1204 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1204 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1204 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1204 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1708 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1708 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1708 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe PID 536 wrote to memory of 1708 536 Scan_DSV_03072020_038465318631_PDF.exe Scan_DSV_03072020_038465318631_PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-54-0x00000000003A0000-0x0000000000474000-memory.dmpFilesize
848KB
-
memory/536-55-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/536-56-0x00000000004C0000-0x00000000004D0000-memory.dmpFilesize
64KB
-
memory/536-57-0x0000000005780000-0x0000000005838000-memory.dmpFilesize
736KB