125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 11:04

Target
pdfstamp_cmd/example/13.bat
Size 242B
Sample240605-m6ek4aee74
SHA256 ec7f242e8f61823989e702757410f9205afb41b43e2508919434d8555e78adaa
MD5 4eb7a87baf8ba21163666278c3bc4f3f
SHA1 b0a8801975e4d38ea26c6626369ca6b2512517ea
SHA512 f920165dfc292109d78c9dadc9bce829915c312ccf3da784b44993672c03cbe015ac919f6c81d722791b9c04d4cc98336d79594b397f60621645853c1d70f6b3
MD5 SHA1 SHA512

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/memory/2404-1-0x00000000002E0000-0x00000000003AE000-memory.dmp	upx
behavioral9/memory/2404-8-0x00000000002E0000-0x00000000003AE000-memory.dmp	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2404	pdfstamp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2404	2412	cmd.exe	29
PID 2412 wrote to memory of 2404	2412	cmd.exe	29
PID 2412 wrote to memory of 2404	2412	cmd.exe	29
PID 2412 wrote to memory of 2404	2412	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\13.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\pdfstamp_cmd\example\pdfstamp.exe
  pdfstamp -PDF "example.pdf" -o "13.pdf" -AI "logo.jpg" -p9 -r-45 -mlr-70 -mtb-70 -AI "logo.jpg" -p9 -r225 -mlr70 -mtb-70 -AI "logo.jpg" -p9 -r135 -mlr70 -mtb70 -AI "logo.jpg" -p9 -r45 -mlr-70 -mtb70
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2404

memory/2404-0-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/2404-1-0x00000000002E0000-0x00000000003AE000-memory.dmp

Download

memory/2404-6-0x0000000010000000-0x0000000010103000-memory.dmp

Download

memory/2404-8-0x00000000002E0000-0x00000000003AE000-memory.dmp

Download