6bddbc25a806579601538d6be846c09c61735fa2198ee7bdcfabb5317e406191

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 08:54

Target

PO#00986.pdf.exe
Size

643KB
MD5

7923c45dcf8871cb20f281986f081b55
SHA1

3d2ffb801be1739263d70add078292f62b3490b9
SHA256

bd03f21ffe0e1b5628a0f890aeb7c186e2330a4e59e554f675fee7994ed3ea5d
SHA512

e254a23f14fded53dea4f3b69d4451b924f391bed5e444baaf6a0482e830aa4561b54a339107f995eaf24d74ba3c88b3d814f77fcfd533801bc4fac2c0c64b0d
SSDEEP

12288:YCWJp09bewSsnk/ZFCNP8n1LrhKGZw7QOLcXo/enFp33CT9wglb9YIE:YCF9bewS6WZQPO1/hKQwf4Xg2pnCT9wf

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3116 set thread context of 3928	3116	PO#00986.pdf.exe	90

Suspicious behavior: EnumeratesProcesses 48 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	PO#00986.pdf.exe
Token: SeDebugPrivilege	3928	PO#00986.pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1632	3116	PO#00986.pdf.exe	89
PID 3116 wrote to memory of 1632	3116	PO#00986.pdf.exe	89
PID 3116 wrote to memory of 1632	3116	PO#00986.pdf.exe	89
PID 3116 wrote to memory of 3928	3116	PO#00986.pdf.exe	90
PID 3116 wrote to memory of 3928	3116	PO#00986.pdf.exe	90
PID 3116 wrote to memory of 3928	3116	PO#00986.pdf.exe	90
PID 3116 wrote to memory of 3928	3116	PO#00986.pdf.exe	90
PID 3116 wrote to memory of 3928	3116	PO#00986.pdf.exe	90
PID 3116 wrote to memory of 3928	3116	PO#00986.pdf.exe	90

C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe"
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#00986.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3928

memory/3116-6-0x0000000005A80000-0x0000000005B1C000-memory.dmp

Filesize
624KB

Download
memory/3116-1-0x0000000000CF0000-0x0000000000D98000-memory.dmp

Filesize
672KB

Download
memory/3116-2-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/3116-3-0x0000000005800000-0x0000000005892000-memory.dmp

Filesize
584KB

Download
memory/3116-4-0x00000000057F0000-0x0000000005800000-memory.dmp

Filesize
64KB

Download
memory/3116-5-0x0000000005760000-0x000000000576A000-memory.dmp

Filesize
40KB

Download
memory/3116-0-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3116-7-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3116-8-0x00000000057F0000-0x0000000005800000-memory.dmp

Filesize
64KB

Download
memory/3116-11-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3928-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3928-12-0x0000000001180000-0x00000000014CA000-memory.dmp

Filesize
3.3MB

Download
memory/3928-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download