13020e32f0b3aa89f6d89526ee3c8d26c7066bdfdd030700fa2420f4e64f542b

Analysis

max time kernel
36s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 10:04

Target
2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
Size 284KB
Sample221124-l4acxsfe32
SHA256 a34dc2d8bfe4df50efffa7f78da986024d6a0822c035ccbac2b68b995a8c35a5
MD5 5227780e4555ca60025d107d5baea9dd
SHA1 73caffd3824697f8686250ef6e6c4ac12ab39252
SHA512 b141e79f076f019bf852f6cd1a5a1c302410294fdb3d1eec4b11b9ed615f76ac1a3c636190fc5d02a4b1b52c0bb9b7d475b7dc92fa7b81b795f715e9fa6b69d4
SSDEEP 6144:1oYT0BiwUyoqwx658IIIOf1G4ELtrWWiz0Lm1+V+XjMSBaf/9:1oY+z8Byb+Xvw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
4748	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1804	4748	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	80
PID 4748 wrote to memory of 1804	4748	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	80
PID 4748 wrote to memory of 1804	4748	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	80
PID 4748 wrote to memory of 2712	4748	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe	54