Analysis
-
max time kernel
132s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 06:46
Static task
static1
Behavioral task
behavioral1
Sample
Processing.Pdf____________________________________________________________.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Processing.Pdf____________________________________________________________.exe
Resource
win10v2004-20220812-en
General
-
Target
Processing.Pdf____________________________________________________________.exe
-
Size
474KB
-
MD5
7e3556dc9dc56ef11af7276854f404c8
-
SHA1
26f676d0a6a0057fe6aa35a0d025c478d8e05741
-
SHA256
efd29f1af6c5e828bc4c1c980ab22ddc0a89c0c7813bf8075b8b8943edc19e5c
-
SHA512
d2a5b2c2ed9f628d2c85bac66eeb6af7d19d1b5baed8577acf83701d08b377c47ff3f00a5e590b96136cfab887c15d62622f54a56cc3dd23a507b985fd288bb2
-
SSDEEP
6144:dipL4qsxpzEOqcQLO8eNpOsYZqQJgOFATNFadd5G/c9FhkZJh4NCf0oxAOQPTRpD:d6UZbzfZmswqfNFQDuJhEJxR8L0
Malware Config
Signatures
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Processing.Pdf____________________________________________________________.exepid process 4740 Processing.Pdf____________________________________________________________.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Processing.Pdf____________________________________________________________.exedescription pid process target process PID 4740 set thread context of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4544 4052 WerFault.exe Processing.Pdf____________________________________________________________.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Processing.Pdf____________________________________________________________.exepid process 4740 Processing.Pdf____________________________________________________________.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Processing.Pdf____________________________________________________________.exedescription pid process target process PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe PID 4740 wrote to memory of 4052 4740 Processing.Pdf____________________________________________________________.exe Processing.Pdf____________________________________________________________.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe"2⤵PID:4052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 83⤵
- Program crash
PID:4544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4052 -ip 40521⤵PID:3128