8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce

Analysis

max time kernel
189s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 16:14

Target

3302-9333-pdf.exe
Size

1.1MB
MD5

9f061ed14a6be403487e1d5d9f57c1c7
SHA1

14b8bb53f104da83ac047a2133b3c16b1c417ae6
SHA256

8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce
SHA512

9af07665a41a5babc582a8b45f02068e7f198ed93edf32c2721448b84fc92c6ee2b1844694079a3d335e5222df27666e4b6ae5f9b6e2725923ad92f8ab94e9e2
SSDEEP

24576:ktfo6PTetbba1C/Ll3HoyhLLGmkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgk:Uo0etbba1C/Ll3HxHRpAuserKvpAuJMO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3302-9333-pdf.exe

description	pid	process	target process
PID 4864 wrote to memory of 4396	4864	3302-9333-pdf.exe	RegAsm.exe
PID 4864 wrote to memory of 4396	4864	3302-9333-pdf.exe	RegAsm.exe
PID 4864 wrote to memory of 4396	4864	3302-9333-pdf.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\3302-9333-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\3302-9333-pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:4396

memory/4396-9-0x00000000003F0000-0x00000000003F0000-memory.dmp

Download
memory/4864-0-0x0000000000DF0000-0x0000000000F04000-memory.dmp

Filesize
1.1MB

Download
memory/4864-1-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/4864-2-0x0000000005900000-0x0000000005954000-memory.dmp

Filesize
336KB

Download
memory/4864-3-0x0000000005F00000-0x00000000064A4000-memory.dmp

Filesize
5.6MB

Download
memory/4864-4-0x00000000059F0000-0x0000000005A82000-memory.dmp

Filesize
584KB

Download
memory/4864-5-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/4864-6-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/4864-7-0x0000000005D40000-0x0000000005DDC000-memory.dmp

Filesize
624KB

Download
memory/4864-8-0x0000000005CB0000-0x0000000005CBA000-memory.dmp

Filesize
40KB

Download
memory/4864-11-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download