840c7c4082f868ca58dc61ce2fa6309ffcbc17c81fd82306eb6ea558eeeba7e2

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2023 10:20

Target

proof of payment.pdf.exe
Size

559KB
MD5

12a020044ef1ff75bfd860bcee9a3762
SHA1

77008edc365f7a4ad1b1be97c1ad4fc5e96869a5
SHA256

840c7c4082f868ca58dc61ce2fa6309ffcbc17c81fd82306eb6ea558eeeba7e2
SHA512

d7d32aa05253cf106d9d3e9e73c51f29366d7d66a58e1e7bfcd928e5b8ee0f2515fcbedd0ab867646edc891b5fef1a306bc8b399102cb7df808aaf6b269897b1
SSDEEP

6144:GCL+2ACrZFup6K1nS+mtiQTCXOgoX93+Tm7Tv7vnvnmc1pBWRWDSG:F26lLtiGaOg693+Tmnrvmc1pBWMm

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\proof of payment.pdf.exe	proof of payment.pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\proof of payment.pdf.exe	proof of payment.pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 2060	2412	proof of payment.pdf.exe	93

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2060	proof of payment.pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2060	2412	proof of payment.pdf.exe	93
PID 2412 wrote to memory of 2060	2412	proof of payment.pdf.exe	93
PID 2412 wrote to memory of 2060	2412	proof of payment.pdf.exe	93
PID 2412 wrote to memory of 2060	2412	proof of payment.pdf.exe	93
PID 2412 wrote to memory of 2060	2412	proof of payment.pdf.exe	93
PID 2412 wrote to memory of 2060	2412	proof of payment.pdf.exe	93
PID 2412 wrote to memory of 2060	2412	proof of payment.pdf.exe	93
PID 2412 wrote to memory of 2060	2412	proof of payment.pdf.exe	93

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\proof of payment.pdf.exe.log

Filesize
1KB

MD5
17573558c4e714f606f997e5157afaac

SHA1
13e16e9415ceef429aaf124139671ebeca09ed23

SHA256
c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

SHA512
f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

Download Submit
memory/2060-141-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2060-146-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/2060-147-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/2412-133-0x00000000003B0000-0x0000000000442000-memory.dmp

Filesize
584KB

Download
memory/2412-134-0x0000000004DD0000-0x0000000004E6C000-memory.dmp

Filesize
624KB

Download
memory/2412-135-0x0000000005420000-0x00000000059C4000-memory.dmp

Filesize
5.6MB

Download
memory/2412-136-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Filesize
584KB

Download
memory/2412-137-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Filesize
40KB

Download
memory/2412-138-0x00000000050C0000-0x0000000005116000-memory.dmp

Filesize
344KB

Download
memory/2412-139-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/2412-140-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download