2af6eb96ef34d5a8b894dc7cbba381f4505c6e9495c8206065adc61bd4e0a9f7

Analysis

max time kernel
120s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 03:07

Target

Fedex Delivery unknown Pdf.exe
Size

2.4MB
MD5

a2d0bac4f8e4e3bff7439e50e1896f0a
SHA1

69f226ca13da30170c202ef3af2f0f3965e93a9b
SHA256

2af6eb96ef34d5a8b894dc7cbba381f4505c6e9495c8206065adc61bd4e0a9f7
SHA512

a4d8a83b3d4afd7858e090a07400cfed75f7340e22f684cb326cfabf040baa698551ef48b5e23ecffe73b5b5806373048bdc4eb1c60ea376b57f833217bec709
SSDEEP

12288:SlfqOMfexYzOMpLE01oy6VVqg5SYk3t+MtRDyPY+49pCNRrydaTjUyfU:IqOCzOyLh1ozIgVk9dFy8TYydgNc

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 4968	1692	Fedex Delivery unknown Pdf.exe	82

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 4968	1692	Fedex Delivery unknown Pdf.exe	82
PID 1692 wrote to memory of 4968	1692	Fedex Delivery unknown Pdf.exe	82
PID 1692 wrote to memory of 4968	1692	Fedex Delivery unknown Pdf.exe	82
PID 1692 wrote to memory of 4968	1692	Fedex Delivery unknown Pdf.exe	82
PID 1692 wrote to memory of 4968	1692	Fedex Delivery unknown Pdf.exe	82
PID 1692 wrote to memory of 4968	1692	Fedex Delivery unknown Pdf.exe	82
PID 1692 wrote to memory of 3156	1692	Fedex Delivery unknown Pdf.exe	83
PID 1692 wrote to memory of 3156	1692	Fedex Delivery unknown Pdf.exe	83
PID 1692 wrote to memory of 3156	1692	Fedex Delivery unknown Pdf.exe	83

C:\Users\Admin\AppData\Local\Temp\Fedex Delivery unknown Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Fedex Delivery unknown Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:3156

memory/1692-1-0x00007FF841563000-0x00007FF841565000-memory.dmp

Filesize
8KB

Download
memory/1692-2-0x000001E4060C0000-0x000001E40615A000-memory.dmp

Filesize
616KB

Download
memory/1692-0-0x000001E4043C0000-0x000001E4043C8000-memory.dmp

Filesize
32KB

Download
memory/1692-3-0x00007FF841560000-0x00007FF842021000-memory.dmp

Filesize
10.8MB

Download
memory/1692-6-0x00007FF841560000-0x00007FF842021000-memory.dmp

Filesize
10.8MB

Download
memory/4968-4-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-5-0x0000000001D60000-0x00000000020AA000-memory.dmp

Filesize
3.3MB

Download
memory/4968-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download