125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/12.bat
Size 270B
Sample240605-m6ek4aee74
SHA256 f2a132240495bc163b96a938f07015548968cadf8502affdaec6d758bf8f794e
MD5 d60f1f4957a037fa9374adc489aea8c0
SHA1 e7e5bc6cb2026e821a3c422c572d03e720f1e2dc
SHA512 164123bef367df34cf819aa3eff5a6dc6b7df7c3f1ea99e499a4619745a5a6d28b9c5528431d76d8d92f1c89a6226004406ec15ca961184436e1d169d258e82a
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral8/memory/3308-2-0x0000000000BD0000-0x0000000000C9E000-memory.dmp	upx
behavioral8/memory/3308-10-0x0000000000BD0000-0x0000000000C9E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3308	4656	cmd.exe	92
PID 4656 wrote to memory of 3308	4656	cmd.exe	92
PID 4656 wrote to memory of 3308	4656	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\12.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDF "example.pdf" -o "12.pdf" -AT "verypdf.com Inc." -p1 -fs48 -c65296 -r-45 -AT "verypdf.com Inc." -p3 -fs48 -c65296 -r45 -AT "verypdf.com Inc." -p5 -fs48 -c65296 -r-45 -AT "verypdf.com Inc." -p7 -fs48 -c65296 -r45
  2⤵
  PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4492

memory/3308-0-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/3308-1-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

Download

memory/3308-2-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

Download

memory/3308-3-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/3308-10-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

Download

memory/3308-9-0x0000000010000000-0x0000000010103000-memory.dmp

Download