626711816f27f8086c61e21a0ef5909fdf0966c75588e6a63690bf9bfe66b718

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 01:22

Target

purchase order pdf.exe
Size

356KB
MD5

be60ea5cc4efb226b78a6a257ff112fd
SHA1

1bc68e94bf651242cd3ca51c34f9113992d4f9a7
SHA256

d7531e4728438f15714cd44a6ed353d5117b4a3b6db1ece8b945ca8eb0b1408d
SHA512

dcb28bde9d6d4726d59c3b62915992c26bbb1cd2f85a89895f8a2ada3ba11c79d0e4dcda4ebac14c257db09ccd0db05959af2db2e2032f622ed6cac8d724400f
SSDEEP

6144:CI8dwrN+sNKki7FYkxcpVotE2586h8YQbWTODuQckHooppgNoo9ELQbkm8UbL0:GUFtOq3Ct186eKwrc+np+Nos9km8U

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

purchase order pdf.exe

description pid process target process

PID 2060 set thread context of 3016 2060 purchase order pdf.exe purchase order pdf.exe

description	pid	process	target process
PID 2060 set thread context of 3016	2060	purchase order pdf.exe	purchase order pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

purchase order pdf.exe

description	pid	process	target process
PID 2060 wrote to memory of 3016	2060	purchase order pdf.exe	purchase order pdf.exe
PID 2060 wrote to memory of 3016	2060	purchase order pdf.exe	purchase order pdf.exe
PID 2060 wrote to memory of 3016	2060	purchase order pdf.exe	purchase order pdf.exe
PID 2060 wrote to memory of 3016	2060	purchase order pdf.exe	purchase order pdf.exe
PID 2060 wrote to memory of 3016	2060	purchase order pdf.exe	purchase order pdf.exe
PID 2060 wrote to memory of 3016	2060	purchase order pdf.exe	purchase order pdf.exe
PID 2060 wrote to memory of 3016	2060	purchase order pdf.exe	purchase order pdf.exe
PID 2060 wrote to memory of 3016	2060	purchase order pdf.exe	purchase order pdf.exe

C:\Users\Admin\AppData\Local\Temp\purchase order pdf.exe
"C:\Users\Admin\AppData\Local\Temp\purchase order pdf.exe"
2⤵
PID:3016

memory/2060-0-0x0000000000280000-0x00000000002E0000-memory.dmp

Filesize
384KB

Download
memory/2060-1-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2060-2-0x0000000000490000-0x00000000004D0000-memory.dmp

Filesize
256KB

Download
memory/2060-7-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/3016-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download