8da7f3f5c82fa1468900d1f92ba263d74d62d0ec4c2128d4aaa260a0baca27a3

Analysis

max time kernel
132s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2023, 08:18

Target
RFQpdf.exe
Size 812KB
Sample230613-j69jpafe42
SHA256 8da7f3f5c82fa1468900d1f92ba263d74d62d0ec4c2128d4aaa260a0baca27a3
MD5 bdf0e665cab0bcd095c1ccf5f912e5f0
SHA1 5b399e5b64104276cd166712d04c1982f5e686f8
SHA512 ebbac37d4c13a172d3b14e8d04307feea41da0f5e27668d0fc2900bc9eaeebc2aa1b60251e955a6505b47def7a06381193020381e8c1dbeb7c15ad7015177754
SSDEEP 24576:qjsXDW2HXHS78SyXhx9D9cU+AsBHeXmxrkSOS2NCyZFkz:ysXDW23HSobD9cJAsBHeW7slZaz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	RFQpdf.exe
1344	RFQpdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	RFQpdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1984	1344	RFQpdf.exe	83
PID 1344 wrote to memory of 1984	1344	RFQpdf.exe	83
PID 1344 wrote to memory of 1984	1344	RFQpdf.exe	83

C:\Users\Admin\AppData\Local\Temp\RFQpdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQpdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
  2⤵
  PID:1984

memory/1344-133-0x000001C946050000-0x000001C946120000-memory.dmp

Download