4eff9b9fcfb59f8402b524565f92e905dbec8c610ec6dadaf9c3cb1fd5c3e5e0

Analysis

max time kernel
46s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/05/2023, 16:00

Target

COTIZACIÓN-38200.pdf.exe
Size

792KB
MD5

89c89a06094b0b65b8a915de16ccb5b5
SHA1

255ea88c676ebaf4cc21e8c8f3e20dd921833d08
SHA256

4eff9b9fcfb59f8402b524565f92e905dbec8c610ec6dadaf9c3cb1fd5c3e5e0
SHA512

dc516879f57ba50f984985c8bb6e29fb4bcb20ff0ea3b56ee45376ade353c6244b09b4659757501c9fd0199b5d9bfdc81c7d394d90e3b7a4591cd82b5a584bfc
SSDEEP

12288:US8hue/3H1JxjnTh4uV/yFoLUgyyEQXtT28Z7oVd+SYXo8EDucM0:UBJxvh4uMSf5TX72d+S/z6c7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1148	COTIZACIÓN-38200.pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 832	1148	COTIZACIÓN-38200.pdf.exe	28
PID 1148 wrote to memory of 832	1148	COTIZACIÓN-38200.pdf.exe	28
PID 1148 wrote to memory of 832	1148	COTIZACIÓN-38200.pdf.exe	28
PID 1148 wrote to memory of 832	1148	COTIZACIÓN-38200.pdf.exe	28
PID 1148 wrote to memory of 272	1148	COTIZACIÓN-38200.pdf.exe	29
PID 1148 wrote to memory of 272	1148	COTIZACIÓN-38200.pdf.exe	29
PID 1148 wrote to memory of 272	1148	COTIZACIÓN-38200.pdf.exe	29
PID 1148 wrote to memory of 272	1148	COTIZACIÓN-38200.pdf.exe	29
PID 1148 wrote to memory of 568	1148	COTIZACIÓN-38200.pdf.exe	30
PID 1148 wrote to memory of 568	1148	COTIZACIÓN-38200.pdf.exe	30
PID 1148 wrote to memory of 568	1148	COTIZACIÓN-38200.pdf.exe	30
PID 1148 wrote to memory of 568	1148	COTIZACIÓN-38200.pdf.exe	30
PID 1148 wrote to memory of 1236	1148	COTIZACIÓN-38200.pdf.exe	31
PID 1148 wrote to memory of 1236	1148	COTIZACIÓN-38200.pdf.exe	31
PID 1148 wrote to memory of 1236	1148	COTIZACIÓN-38200.pdf.exe	31
PID 1148 wrote to memory of 1236	1148	COTIZACIÓN-38200.pdf.exe	31
PID 1148 wrote to memory of 1348	1148	COTIZACIÓN-38200.pdf.exe	32
PID 1148 wrote to memory of 1348	1148	COTIZACIÓN-38200.pdf.exe	32
PID 1148 wrote to memory of 1348	1148	COTIZACIÓN-38200.pdf.exe	32
PID 1148 wrote to memory of 1348	1148	COTIZACIÓN-38200.pdf.exe	32

C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe"
  2⤵
  PID:832
- C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe"
  2⤵
  PID:272
- C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe"
  2⤵
  PID:568
- C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe"
  2⤵
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN-38200.pdf.exe"
  2⤵
  PID:1348

memory/1148-54-0x0000000000360000-0x000000000042C000-memory.dmp

Filesize
816KB

Download
memory/1148-55-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/1148-56-0x0000000000A00000-0x0000000000A0E000-memory.dmp

Filesize
56KB

Download
memory/1148-57-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/1148-58-0x0000000000A10000-0x0000000000A1A000-memory.dmp

Filesize
40KB

Download
memory/1148-59-0x0000000004810000-0x000000000487A000-memory.dmp

Filesize
424KB

Download
memory/1148-60-0x00000000048F0000-0x0000000004922000-memory.dmp

Filesize
200KB

Download