125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/10.bat
Size 251B
Sample240605-m6ek4aee74
SHA256 cca6c3b08b93defc852366338345e138ff882aca9fc2ec9c56204e8993c61911
MD5 f518d92606e9622b155f4b9039aefbde
SHA1 c8214d72630ef9b363f21d3a85fb9a05a4da6b7f
SHA512 650fb0cd3298cfbd1f776b1b5ba9cc73464a09f8075ed574bf158eae95c28a70e655105eb953b920c3e1e58aed072ba5ee0eea788009a89d258d5236a1edb1d9
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/2136-0-0x0000000010000000-0x00000000100CE000-memory.dmp	upx
behavioral4/memory/2136-6-0x0000000010000000-0x00000000100CE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 2136	4268	cmd.exe	83
PID 4268 wrote to memory of 2136	4268	cmd.exe	83
PID 4268 wrote to memory of 2136	4268	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\10.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDF "example.pdf" -o "10.pdf" -AT "Wrap text to a new line if it would otherwise be too long to fit in its margined area." -p9 -fs64 -c2666666
  2⤵
  PID:2136

memory/2136-0-0x0000000010000000-0x00000000100CE000-memory.dmp

Download

memory/2136-1-0x0000000000C00000-0x0000000000D03000-memory.dmp

Download

memory/2136-6-0x0000000010000000-0x00000000100CE000-memory.dmp

Download

memory/2136-7-0x0000000000C00000-0x0000000000D03000-memory.dmp

Download