125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/19-pdfs.bat
Size 111B
Sample240605-m6ek4aee74
SHA256 7b11fa292892cd8f453b7e7e78a1bef9c2816bb2a7ad93dce97280bd90d32fb3
MD5 6b50d6372eec9518b37989475a529354
SHA1 07f3a59c9c2e8837feea3e078180972380a1c65b
SHA512 6ad96b873f1929532a0472043041a27764a653f9ccb2da1ba2cca97bf456a760b03c15e2168ef3d03ed4040f24d1fa1c8bee9d7b35dfd403b8e23d329a49fbb6
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral22/memory/2384-1-0x0000000000A90000-0x0000000000B5E000-memory.dmp	upx
behavioral22/memory/2384-31-0x0000000000A90000-0x0000000000B5E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2384	1548	cmd.exe	84
PID 1548 wrote to memory of 2384	1548	cmd.exe	84
PID 1548 wrote to memory of 2384	1548	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\19-pdfs.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDFs "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\*.pdf" -o "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\out" -AT "An example for '-PDFS' parameter" -p2 -fs32 -c2666666 -mtb200
  2⤵
  PID:2384

test_stamp_barcode.pdf

Path C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\out\test_stamp_barcode.pdf
Size 74KB
SHA256 4a80d4e15f2515c8e9b3eb86a66e6c193c26f70d5aa47001531faf03a3409c41
MD5 0529e9edf25e3f55b7e8f0a8ef687523
SHA1 d3da9f93dc116a5764470177123ebcb7bd466c24
SHA512 af09d171313d60be635f308db20f8c8562f47256017b4ee5d1acc5b44f688aeebeb94deca060b6e06cec3cd5a254a304c8b198fcf05d29c6c3654a5a359bf8b0
SSDEEP 1536:zTcrp9/W+cDnyL/pn5gTg2gHUbsKGsdE5sCSkxrw1TU+CmIvVHB:zYKf7yLhn5KqUhGsdOsC0tG7vVh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2384-0-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/2384-1-0x0000000000A90000-0x0000000000B5E000-memory.dmp

Download

memory/2384-31-0x0000000000A90000-0x0000000000B5E000-memory.dmp

Download

memory/2384-30-0x0000000010000000-0x0000000010103000-memory.dmp

Download