125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
149s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/1.bat
Size 352B
Sample240605-m6ek4aee74
SHA256 c3c6d3376c5f9248f22635e98bfd3240fa57e359262802ee31dda1b280d0f6e4
MD5 8346e4de0b9c79f496fb6a3c1f49e8e6
SHA1 80c5c9293c3671d5f3791c5cdd3e00af4e9c5062
SHA512 214b9a09827255358e05a980af50d6d393f4fefeaea026d915be6873b9a98a6e390f544188b465ae0ee4e230c09914f5a03a6b95f2c55b5663528027cbfac690
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4756-1-0x0000000000C00000-0x0000000000CCE000-memory.dmp	upx
behavioral2/memory/4756-2-0x0000000000C00000-0x0000000000CCE000-memory.dmp	upx
behavioral2/memory/4756-9-0x0000000000C00000-0x0000000000CCE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4756	3700	cmd.exe	84
PID 3700 wrote to memory of 4756	3700	cmd.exe	84
PID 3700 wrote to memory of 4756	3700	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDF "example.pdf" -o "1.pdf" -AT "\d\n\t - (\f)" -fs10 -p7 -c255 -mlr50 -mtb-30 -AT "Page \p of \c " -fs10 -p5 -c255 -mlr-50 -mtb-30 -AT "2003 verypdf.com Inc.\n\F" -p3 -mlr-30 -mtb30 -fs10 -fn300 -c2666666
  2⤵
  PID:4756

memory/4756-0-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/4756-1-0x0000000000C00000-0x0000000000CCE000-memory.dmp

Download

memory/4756-2-0x0000000000C00000-0x0000000000CCE000-memory.dmp

Download

memory/4756-9-0x0000000000C00000-0x0000000000CCE000-memory.dmp

Download

memory/4756-7-0x0000000010000000-0x0000000010103000-memory.dmp

Download