e9cc0af19d1d8bafdef3ffb9dae747c83cce8b83718ca9d6ef95c80d6e66b344

Analysis

max time kernel
60s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-08-2022 04:21

Target

PO.17822.pdf.exe
Size

745KB
MD5

de9b712ef2b81341e7ffbc46ffc10f33
SHA1

5bdfb2bed56472cf2c57aefaafa28c6d7e21fa8d
SHA256

e9cc0af19d1d8bafdef3ffb9dae747c83cce8b83718ca9d6ef95c80d6e66b344
SHA512

0a9a1d1638a83544c239e62c08eef023834812d6267304ee879a2aa2bb744685254afe83993718de76467bb975de75e6c745383c6cee30bae8459feef20c168c

Score

1^/10

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

PO.17822.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO.17822.pdf.exe

description pid process

Token: SeDebugPrivilege 1808 PO.17822.pdf.exe

description	pid	process
Token: SeDebugPrivilege	1808	PO.17822.pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

PO.17822.pdf.exe

description	pid	process	target process
PID 1808 wrote to memory of 1956	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1956	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1956	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1956	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 828	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 828	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 828	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 828	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1996	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1996	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1996	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1996	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 936	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 936	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 936	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 936	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1804	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1804	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1804	1808	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 1808 wrote to memory of 1804	1808	PO.17822.pdf.exe	PO.17822.pdf.exe

C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe"
2⤵
PID:1956

C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe"
2⤵
PID:828

C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe"
2⤵
PID:1996

C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe"
2⤵
PID:936

C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe"
2⤵
PID:1804

memory/1808-54-0x00000000003E0000-0x000000000049E000-memory.dmp

Filesize
760KB

Download
memory/1808-55-0x0000000076051000-0x0000000076053000-memory.dmp

Filesize
8KB

Download
memory/1808-56-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download
memory/1808-57-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/1808-58-0x00000000052D0000-0x000000000536C000-memory.dmp

Filesize
624KB

Download
memory/1808-59-0x0000000004BF0000-0x0000000004C48000-memory.dmp

Filesize
352KB

Download