125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/12.bat
Size 270B
Sample240605-m6ek4aee74
SHA256 f2a132240495bc163b96a938f07015548968cadf8502affdaec6d758bf8f794e
MD5 d60f1f4957a037fa9374adc489aea8c0
SHA1 e7e5bc6cb2026e821a3c422c572d03e720f1e2dc
SHA512 164123bef367df34cf819aa3eff5a6dc6b7df7c3f1ea99e499a4619745a5a6d28b9c5528431d76d8d92f1c89a6226004406ec15ca961184436e1d169d258e82a
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/2500-1-0x0000000000320000-0x00000000003EE000-memory.dmp	upx
behavioral7/memory/2500-7-0x0000000000320000-0x00000000003EE000-memory.dmp	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2500	pdfstamp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2500	2684	cmd.exe	29
PID 2684 wrote to memory of 2500	2684	cmd.exe	29
PID 2684 wrote to memory of 2500	2684	cmd.exe	29
PID 2684 wrote to memory of 2500	2684	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\12.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDF "example.pdf" -o "12.pdf" -AT "verypdf.com Inc." -p1 -fs48 -c65296 -r-45 -AT "verypdf.com Inc." -p3 -fs48 -c65296 -r45 -AT "verypdf.com Inc." -p5 -fs48 -c65296 -r-45 -AT "verypdf.com Inc." -p7 -fs48 -c65296 -r45
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2500

memory/2500-1-0x0000000000320000-0x00000000003EE000-memory.dmp

Download

memory/2500-7-0x0000000000320000-0x00000000003EE000-memory.dmp

Download

memory/2500-6-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/2500-0-0x0000000010000000-0x0000000010103000-memory.dmp

Download