e14274d9724505d314d2025563420b4e5064f5f54e4dc6a22f0d2dc7031f340c

Analysis

max time kernel
155s
max time network
297s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28/05/2024, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WS.PDFelement.Pro.8.3.8.1253/WS.PDFelement.OCR.Plugin/OCR Plugin.exe
Size 388.2MB
Sample240528-k2mpssde4y
SHA256 fd3292348856a9839771420dbec8706d819bd7e949e47199cf7b8f11ca347ad0
MD5 5233557e789b77bc870173335069ec13
SHA1 33bb4146dbf7143da45cc242ea6d58c5c816ca9b
SHA512 783d9c4869d2f932d23683c6461d2cb17b719f47dfd18c96fced1997c63e78daeb6352d1e6bf8d05c47f24b2bce96b162a96af319368cd10bb7b9430b08d2544
SSDEEP 6291456:8D28zzfP+Gsthgb3IpsUS4X79sm/XQuP8yIR8ptYJ92kTLJ4F34P3sKuMTXWSHpU:8D2ozXNsrE4ySX7Pt8yRMWPG2hpB
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4824	OCR Plugin.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4824	2332	OCR Plugin.exe	72
PID 2332 wrote to memory of 4824	2332	OCR Plugin.exe	72
PID 2332 wrote to memory of 4824	2332	OCR Plugin.exe	72

C:\Users\Admin\AppData\Local\Temp\WS.PDFelement.Pro.8.3.8.1253\WS.PDFelement.OCR.Plugin\OCR Plugin.exe
"C:\Users\Admin\AppData\Local\Temp\WS.PDFelement.Pro.8.3.8.1253\WS.PDFelement.OCR.Plugin\OCR Plugin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\is-DF14U.tmp\OCR Plugin.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DF14U.tmp\OCR Plugin.tmp" /SL5="$8022C,406307185,377856,C:\Users\Admin\AppData\Local\Temp\WS.PDFelement.Pro.8.3.8.1253\WS.PDFelement.OCR.Plugin\OCR Plugin.exe"
  2⤵
  - Executes dropped EXE
  PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

OCR Plugin.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DF14U.tmp\OCR Plugin.tmp
Size 1.6MB
SHA256 c5e268d3108185eea0e379c5f53c6dde71cb3d3ea5a23ab974a4e8c0110c846b
MD5 7da9e674df69abd9ea37759510b29c99
SHA1 0235edc5c1fe57b1a046b33a96b1c3462c158a4c
SHA512 ddc08187733444a7f047ae616afe76bc6b0c8c05d2829f947ad10d3cef820e9c2c2f1322425517124525717de928fe3b85a6d39da52e12f3aec89f034011405f
SSDEEP 49152:zxJsFZKCuJQkO2cC2UoGqqqqqqqqqqqqqqqqq7qqsqqqqqqqqqqqqqqqqqxqqqgD:1JsFdKQkO2BoGqqqqqqqqqqqqqqqqq7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2332-1-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/2332-2-0x0000000000401000-0x0000000000417000-memory.dmp

Download

memory/2332-13-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/2332-20-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/4824-7-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4824-14-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4824-19-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads