125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
133s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/4.bat
Size 447B
Sample240605-m6ek4aee74
SHA256 572a150748661b700154fd4a581f6cffe68fcd2d84832b78007a4d505dd1bb6b
MD5 973cc25164851990347a01e6c037bad0
SHA1 52ffb8362ae0fa50e21fca4589ae792e8f9e1fa1
SHA512 bf687ed44d18802d32f53699cbcdc64253c08ce01c7333647249763f84efc1deec7d4f56dcfb841255b97a145c9094a31fde080c3c051d784cb45210427acdf6
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral28/memory/1676-1-0x0000000000BD0000-0x0000000000C9E000-memory.dmp	upx
behavioral28/memory/1676-2-0x0000000000BD0000-0x0000000000C9E000-memory.dmp	upx
behavioral28/memory/1676-10-0x0000000000BD0000-0x0000000000C9E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 1676	4152	cmd.exe	83
PID 4152 wrote to memory of 1676	4152	cmd.exe	83
PID 4152 wrote to memory of 1676	4152	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\4.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDF "example.pdf" -o "4.pdf" -AT "www.verypdf.com" -p9 -r-20 -c13684944 -fs48 -fn201 -h
  2⤵
  PID:1676

memory/1676-0-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/1676-1-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

Download

memory/1676-2-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

Download

memory/1676-9-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/1676-10-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

Download