7e3d633c1840ccfb34563bb3f937a4b11f7c2eb36b8733d06023c3cb7f0667fc

Analysis

max time kernel
50s
max time network
45s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
19/07/2022, 07:18

Target
CUSTOMER ADVISORY -PDF.exe
Size 697KB
Sample220719-h4x77seec2
SHA256 7e3d633c1840ccfb34563bb3f937a4b11f7c2eb36b8733d06023c3cb7f0667fc
MD5 2ee3376d39e9a83c6c8bba420095cb23
SHA1 7fc01fbb0e55691fab3655dc22d2693e0072c67e
SHA512 41be1e0d7284b6f63c497610a636ca010f23f5d152a203890a2c6ec3e97ded8966550c9565ead36fc7935094dc2baeb4003d75479707a78233129e67792990f7
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	CUSTOMER ADVISORY -PDF.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 972	996	CUSTOMER ADVISORY -PDF.exe	27
PID 996 wrote to memory of 972	996	CUSTOMER ADVISORY -PDF.exe	27
PID 996 wrote to memory of 972	996	CUSTOMER ADVISORY -PDF.exe	27
PID 996 wrote to memory of 972	996	CUSTOMER ADVISORY -PDF.exe	27
PID 996 wrote to memory of 760	996	CUSTOMER ADVISORY -PDF.exe	28
PID 996 wrote to memory of 760	996	CUSTOMER ADVISORY -PDF.exe	28
PID 996 wrote to memory of 760	996	CUSTOMER ADVISORY -PDF.exe	28
PID 996 wrote to memory of 760	996	CUSTOMER ADVISORY -PDF.exe	28
PID 996 wrote to memory of 1732	996	CUSTOMER ADVISORY -PDF.exe	29
PID 996 wrote to memory of 1732	996	CUSTOMER ADVISORY -PDF.exe	29
PID 996 wrote to memory of 1732	996	CUSTOMER ADVISORY -PDF.exe	29
PID 996 wrote to memory of 1732	996	CUSTOMER ADVISORY -PDF.exe	29
PID 996 wrote to memory of 800	996	CUSTOMER ADVISORY -PDF.exe	30
PID 996 wrote to memory of 800	996	CUSTOMER ADVISORY -PDF.exe	30
PID 996 wrote to memory of 800	996	CUSTOMER ADVISORY -PDF.exe	30
PID 996 wrote to memory of 800	996	CUSTOMER ADVISORY -PDF.exe	30
PID 996 wrote to memory of 1692	996	CUSTOMER ADVISORY -PDF.exe	31
PID 996 wrote to memory of 1692	996	CUSTOMER ADVISORY -PDF.exe	31
PID 996 wrote to memory of 1692	996	CUSTOMER ADVISORY -PDF.exe	31
PID 996 wrote to memory of 1692	996	CUSTOMER ADVISORY -PDF.exe	31

C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe
"C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe"
  2⤵
  PID:972
- C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe"
  2⤵
  PID:760
- C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe"
  2⤵
  PID:800
- C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\CUSTOMER ADVISORY -PDF.exe"
  2⤵
  PID:1692

memory/996-54-0x0000000000370000-0x0000000000424000-memory.dmp

Download

memory/996-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/996-56-0x0000000000350000-0x0000000000366000-memory.dmp

Download

memory/996-57-0x0000000000440000-0x000000000044A000-memory.dmp

Download

memory/996-58-0x00000000005C0000-0x0000000000616000-memory.dmp

Download

memory/996-59-0x0000000000550000-0x0000000000570000-memory.dmp

Download