125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
93s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/6.bat
Size 172B
Sample240605-m6ek4aee74
SHA256 60931baa5a4f58815feb80b7a59e685fbb00d01fc5c65732e0c63a5cf910c76f
MD5 df310fe2ab91c8e10c3b74a6450018a1
SHA1 40685dc62b0d3d5d06db87c3c277e31e327074e7
SHA512 954aef4d6709e477a93260fffa83a4aaa68c6e59ac97c16981c424c7944855acd6929d20e4d2e5b427285f085d71119115c01e79b357513329664832a8347fca
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral32/memory/1112-0-0x0000000010000000-0x00000000100CE000-memory.dmp	upx
behavioral32/memory/1112-8-0x0000000010000000-0x00000000100CE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 1112	3764	cmd.exe	83
PID 3764 wrote to memory of 1112	3764	cmd.exe	83
PID 3764 wrote to memory of 1112	3764	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\6.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDF "example.pdf" -o "6.pdf" -AT "www.verypdf.com" -p9 -r45 -c2105376 -fs64 -mlr1 -mtb1 -AT "www.verypdf.com" -p9 -r45 -c255 -fs64
  2⤵
  PID:1112

memory/1112-1-0x0000000000BE0000-0x0000000000CE3000-memory.dmp

Download

memory/1112-0-0x0000000010000000-0x00000000100CE000-memory.dmp

Download

memory/1112-9-0x0000000000BE0000-0x0000000000CE3000-memory.dmp

Download

memory/1112-8-0x0000000010000000-0x00000000100CE000-memory.dmp

Download