67111d8a726c358c56341c8aabc479e49de68e1806a7ef70d348d8a915990e67

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 01:10

Target

arrival notice_pdf.exe
Size

1.2MB
MD5

0a45cffdcecf877a9c48a8e66d15784c
SHA1

3726e50adb2798cee3ac320ff6af9d9c449734f0
SHA256

67111d8a726c358c56341c8aabc479e49de68e1806a7ef70d348d8a915990e67
SHA512

797d92abdf9cde205e4a578f7008421f49f6856f12ad8efa8d2c94ba0af9c53476043151eee75f746eb12015563a54a279a0416825bdd935c57dba5e6c75c0d4
SSDEEP

24576:gAHnh+eWsN3skA4RV1Hom2KXMmHaQqbBwU9O59YcQQ5:Xh+ZkldoPK8YaQUg59nT

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4836 set thread context of 1124	4836	arrival notice_pdf.exe	81

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4836	arrival notice_pdf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4836	arrival notice_pdf.exe
4836	arrival notice_pdf.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4836	arrival notice_pdf.exe
4836	arrival notice_pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1124	4836	arrival notice_pdf.exe	81
PID 4836 wrote to memory of 1124	4836	arrival notice_pdf.exe	81
PID 4836 wrote to memory of 1124	4836	arrival notice_pdf.exe	81
PID 4836 wrote to memory of 1124	4836	arrival notice_pdf.exe	81

C:\Users\Admin\AppData\Local\Temp\arrival notice_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\arrival notice_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\arrival notice_pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

C:\Users\Admin\AppData\Local\Temp\aut4556.tmp

Filesize
268KB

MD5
2f3331dfc5619b01703b44633b33b9c7

SHA1
ecb8090bf20e5c46a2053207b5b96d8eb3187500

SHA256
e1d147a63569095f9403167a0c3eea73874ddf6865f41a780e532b8173025806

SHA512
91e921533f78b801126d53848666e0ed537fdd8915d3f7ffc361adbf71c736d79b51315d2d60db803d32f1c1fe0d541be4015f4f893d4248ea41cb1c0c9e2184

Download Submit
memory/1124-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1124-14-0x0000000001800000-0x0000000001B4A000-memory.dmp

Filesize
3.3MB

Download
memory/1124-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1124-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4836-12-0x0000000000B80000-0x0000000000B84000-memory.dmp

Filesize
16KB

Download