67111d8a726c358c56341c8aabc479e49de68e1806a7ef70d348d8a915990e67

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 01:10

Target

arrival notice_pdf.exe
Size

1.2MB
MD5

0a45cffdcecf877a9c48a8e66d15784c
SHA1

3726e50adb2798cee3ac320ff6af9d9c449734f0
SHA256

67111d8a726c358c56341c8aabc479e49de68e1806a7ef70d348d8a915990e67
SHA512

797d92abdf9cde205e4a578f7008421f49f6856f12ad8efa8d2c94ba0af9c53476043151eee75f746eb12015563a54a279a0416825bdd935c57dba5e6c75c0d4
SSDEEP

24576:gAHnh+eWsN3skA4RV1Hom2KXMmHaQqbBwU9O59YcQQ5:Xh+ZkldoPK8YaQUg59nT

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 2172	1652	arrival notice_pdf.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1652	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1652	arrival notice_pdf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1652	arrival notice_pdf.exe
1652	arrival notice_pdf.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1652	arrival notice_pdf.exe
1652	arrival notice_pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2172	1652	arrival notice_pdf.exe	28
PID 1652 wrote to memory of 2172	1652	arrival notice_pdf.exe	28
PID 1652 wrote to memory of 2172	1652	arrival notice_pdf.exe	28
PID 1652 wrote to memory of 2172	1652	arrival notice_pdf.exe	28
PID 1652 wrote to memory of 2172	1652	arrival notice_pdf.exe	28
PID 1652 wrote to memory of 3056	1652	arrival notice_pdf.exe	29
PID 1652 wrote to memory of 3056	1652	arrival notice_pdf.exe	29
PID 1652 wrote to memory of 3056	1652	arrival notice_pdf.exe	29
PID 1652 wrote to memory of 3056	1652	arrival notice_pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\arrival notice_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\arrival notice_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\arrival notice_pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 316
  2⤵
  - Program crash
  PID:3056

C:\Users\Admin\AppData\Local\Temp\batchers

Filesize
268KB

MD5
2f3331dfc5619b01703b44633b33b9c7

SHA1
ecb8090bf20e5c46a2053207b5b96d8eb3187500

SHA256
e1d147a63569095f9403167a0c3eea73874ddf6865f41a780e532b8173025806

SHA512
91e921533f78b801126d53848666e0ed537fdd8915d3f7ffc361adbf71c736d79b51315d2d60db803d32f1c1fe0d541be4015f4f893d4248ea41cb1c0c9e2184

Download Submit
memory/1652-11-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download
memory/2172-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2172-13-0x0000000000A70000-0x0000000000D73000-memory.dmp

Filesize
3.0MB

Download
memory/2172-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2172-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download