6b263f98ac9778a011f88b1fcf367e38df9cd9019cda667d1a166d190d059558

Analysis

max time kernel
54s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 05:18

Target

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe
Size

288KB
MD5

1785cc3bee48dcc3dea29636307cd632
SHA1

63d4dccbf1859747e207ff6a119a41a50fb42d8b
SHA256

f815a4192d09d50a60e9102216fe5ae1c398a0c345d75664a86ebc06d618e674
SHA512

5b0f87adfbf540f9c08be7507cb682995be484493fbee08958da22436c3e323498387d7da800b13400dfd21523a75ce8294058d15655f9deccd39461aa0efc4d
SSDEEP

6144:ApwPQxhejYZTMzoixretHGSH3AoacYGcIhHKEeW+WzWcaBGP:AL3smHQoYIhMPEW9GP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe

description pid process

Token: SeDebugPrivilege 2004 2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe

description	pid	process
Token: SeDebugPrivilege	2004	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe

description	pid	process	target process
PID 2004 wrote to memory of 2180	2004	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 2004 wrote to memory of 2180	2004	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe
PID 2004 wrote to memory of 2180	2004	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.pdf.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6114~1.BAT"
2⤵
PID:2180

memory/2084-133-0x00007FFACD910000-0x00007FFACD920000-memory.dmp

Filesize
64KB

Download
memory/2180-132-0x0000000000000000-mapping.dmp

Download