8da7f3f5c82fa1468900d1f92ba263d74d62d0ec4c2128d4aaa260a0baca27a3

Analysis

max time kernel
149s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 08:19

Target

RFQpdf.exe
Size

812KB
MD5

bdf0e665cab0bcd095c1ccf5f912e5f0
SHA1

5b399e5b64104276cd166712d04c1982f5e686f8
SHA256

8da7f3f5c82fa1468900d1f92ba263d74d62d0ec4c2128d4aaa260a0baca27a3
SHA512

ebbac37d4c13a172d3b14e8d04307feea41da0f5e27668d0fc2900bc9eaeebc2aa1b60251e955a6505b47def7a06381193020381e8c1dbeb7c15ad7015177754
SSDEEP

24576:qjsXDW2HXHS78SyXhx9D9cU+AsBHeXmxrkSOS2NCyZFkz:ysXDW23HSobD9cJAsBHeW7slZaz

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1976	2012	RFQpdf.exe	28

Suspicious behavior: EnumeratesProcesses 31 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	RFQpdf.exe
Token: SeDebugPrivilege	1976	Regsvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28
PID 2012 wrote to memory of 1976	2012	RFQpdf.exe	28

memory/1976-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1976-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1976-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1976-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1976-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1976-61-0x0000000000950000-0x0000000000C53000-memory.dmp

Filesize
3.0MB

Download
memory/1976-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2012-54-0x00000000003B0000-0x0000000000480000-memory.dmp

Filesize
832KB

Download
memory/2012-55-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download