483d3db33740a19cf3e53acd5a0b50e223121c6828553d14449a6dc12497e894

Analysis

max time kernel
125s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2023 02:34

Target

PO#757764.PDF.exe
Size

367KB
MD5

7d35dcb3b0fbd2ac5df7fa3bd140d5ed
SHA1

a7976420e477172042cd97c7e717b6fe793e9e9a
SHA256

483d3db33740a19cf3e53acd5a0b50e223121c6828553d14449a6dc12497e894
SHA512

a73434f71723cef7b88430d824d50d742861dc9afde4ee4eb5d9aa1075a2dd8310c112a54921cc34c69caedde51937fae4d0415dbfe3838922cd6f143d9c0b74
SSDEEP

6144:yAY8QgjLaR06z1RI5HiZB/vgiEIogkzeXk0uEGpJSVwaPZP8sqgds8wJdbrrhLPl:BaR06z1RI5HgdEgkzeXkWusDdsIDvywi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

PO#757764.PDF.exe

description	pid	process	target process
PID 1300 wrote to memory of 4880	1300	PO#757764.PDF.exe	RegAsm.exe
PID 1300 wrote to memory of 4880	1300	PO#757764.PDF.exe	RegAsm.exe
PID 1300 wrote to memory of 4880	1300	PO#757764.PDF.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\PO#757764.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PO#757764.PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:4880

memory/1300-0-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/1300-1-0x00000000003F0000-0x0000000000452000-memory.dmp

Filesize
392KB

Download
memory/1300-2-0x0000000005360000-0x0000000005904000-memory.dmp

Filesize
5.6MB

Download
memory/1300-3-0x0000000004E50000-0x0000000004EE2000-memory.dmp

Filesize
584KB

Download
memory/1300-4-0x0000000004EF0000-0x0000000004F44000-memory.dmp

Filesize
336KB

Download
memory/1300-5-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/1300-6-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/1300-7-0x0000000000B60000-0x0000000000BFC000-memory.dmp

Filesize
624KB

Download
memory/1300-8-0x0000000000A90000-0x0000000000A9A000-memory.dmp

Filesize
40KB

Download
memory/1300-10-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/1300-11-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download