b8d6ff46309ca17651ebe70e1b648b5266b1285b132d1e6894a589c0f852c583

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 08:48

Target

ORDER_INQUIRY_PDF.exe
Size

236KB
MD5

83e8748124bf874c784ce28d0dcd33f6
SHA1

72006aa1d15993cdaa5790f49acbfea0da3ed726
SHA256

c11bc6cda3987c89debad64d01c2e8d425d809e45db19c46d826f944891c1efe
SHA512

d6ccc82440201f96903e274959c78dbd44f95681294d1a55426063eb2f14fc17c5301171a7b401e5e2e44d19a6cc366372e2275c358832eed52f3aafd0058085
SSDEEP

6144:4du7zrlg25KFpMXp58+DDqFnvhydhcoKQ:frowXDDQ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	ORDER_INQUIRY_PDF.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2172	1744	ORDER_INQUIRY_PDF.exe	28
PID 1744 wrote to memory of 2172	1744	ORDER_INQUIRY_PDF.exe	28
PID 1744 wrote to memory of 2172	1744	ORDER_INQUIRY_PDF.exe	28
PID 1744 wrote to memory of 2172	1744	ORDER_INQUIRY_PDF.exe	28
PID 1744 wrote to memory of 2304	1744	ORDER_INQUIRY_PDF.exe	29
PID 1744 wrote to memory of 2304	1744	ORDER_INQUIRY_PDF.exe	29
PID 1744 wrote to memory of 2304	1744	ORDER_INQUIRY_PDF.exe	29
PID 1744 wrote to memory of 2304	1744	ORDER_INQUIRY_PDF.exe	29
PID 1744 wrote to memory of 2628	1744	ORDER_INQUIRY_PDF.exe	30
PID 1744 wrote to memory of 2628	1744	ORDER_INQUIRY_PDF.exe	30
PID 1744 wrote to memory of 2628	1744	ORDER_INQUIRY_PDF.exe	30
PID 1744 wrote to memory of 2628	1744	ORDER_INQUIRY_PDF.exe	30
PID 1744 wrote to memory of 2668	1744	ORDER_INQUIRY_PDF.exe	31
PID 1744 wrote to memory of 2668	1744	ORDER_INQUIRY_PDF.exe	31
PID 1744 wrote to memory of 2668	1744	ORDER_INQUIRY_PDF.exe	31
PID 1744 wrote to memory of 2668	1744	ORDER_INQUIRY_PDF.exe	31
PID 1744 wrote to memory of 2632	1744	ORDER_INQUIRY_PDF.exe	32
PID 1744 wrote to memory of 2632	1744	ORDER_INQUIRY_PDF.exe	32
PID 1744 wrote to memory of 2632	1744	ORDER_INQUIRY_PDF.exe	32
PID 1744 wrote to memory of 2632	1744	ORDER_INQUIRY_PDF.exe	32

C:\Users\Admin\AppData\Local\Temp\ORDER_INQUIRY_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_INQUIRY_PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2632

memory/1744-0-0x000007FEF5553000-0x000007FEF5554000-memory.dmp

Filesize
4KB

Download
memory/1744-1-0x0000000000FD0000-0x0000000001010000-memory.dmp

Filesize
256KB

Download
memory/1744-2-0x000007FEF5550000-0x000007FEF5F3C000-memory.dmp

Filesize
9.9MB

Download
memory/1744-3-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download
memory/1744-4-0x000007FEF5550000-0x000007FEF5F3C000-memory.dmp

Filesize
9.9MB

Download