7eaa347573db3f24316a9ab2d30256db4d35105c7d93f9dbf8d860ec99949280

Analysis

max time kernel
41s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 13:18

Target

Quotation List Pdf.exe
Size

2.3MB
MD5

9cfd62fc26438eeb8a50922265ad0ea7
SHA1

6bf1e9ab8b0d0c486b85649cf3bc8c1db4b21b01
SHA256

7eaa347573db3f24316a9ab2d30256db4d35105c7d93f9dbf8d860ec99949280
SHA512

44dfe12929105d92bd1b1613ba10b3196030887b784727f646b9b17aabde242b65b87c41a9227103ab8ccb55d5163ecb5115283435b51855dc847da47e699e95
SSDEEP

49152:EF50a6aPVOFMx3SmroCZscivbS6mqxEWoKmqZJffp3vSsqPUceaw1GwNOmExG6f:2roA7PdsE86f

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1820 set thread context of 4356	1820	Quotation List Pdf.exe	86

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2248	1820	Quotation List Pdf.exe	82
PID 1820 wrote to memory of 2248	1820	Quotation List Pdf.exe	82
PID 1820 wrote to memory of 2248	1820	Quotation List Pdf.exe	82
PID 1820 wrote to memory of 2248	1820	Quotation List Pdf.exe	82
PID 1820 wrote to memory of 3636	1820	Quotation List Pdf.exe	83
PID 1820 wrote to memory of 3636	1820	Quotation List Pdf.exe	83
PID 1820 wrote to memory of 3636	1820	Quotation List Pdf.exe	83
PID 1820 wrote to memory of 3636	1820	Quotation List Pdf.exe	83
PID 1820 wrote to memory of 2444	1820	Quotation List Pdf.exe	84
PID 1820 wrote to memory of 2444	1820	Quotation List Pdf.exe	84
PID 1820 wrote to memory of 2444	1820	Quotation List Pdf.exe	84
PID 1820 wrote to memory of 2444	1820	Quotation List Pdf.exe	84
PID 1820 wrote to memory of 2708	1820	Quotation List Pdf.exe	85
PID 1820 wrote to memory of 2708	1820	Quotation List Pdf.exe	85
PID 1820 wrote to memory of 2708	1820	Quotation List Pdf.exe	85
PID 1820 wrote to memory of 2708	1820	Quotation List Pdf.exe	85
PID 1820 wrote to memory of 4356	1820	Quotation List Pdf.exe	86
PID 1820 wrote to memory of 4356	1820	Quotation List Pdf.exe	86
PID 1820 wrote to memory of 4356	1820	Quotation List Pdf.exe	86
PID 1820 wrote to memory of 4356	1820	Quotation List Pdf.exe	86
PID 1820 wrote to memory of 4356	1820	Quotation List Pdf.exe	86
PID 1820 wrote to memory of 4356	1820	Quotation List Pdf.exe	86

C:\Users\Admin\AppData\Local\Temp\Quotation List Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation List Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2248
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:3636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356

memory/4356-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4356-1-0x0000000001980000-0x0000000001CCA000-memory.dmp

Filesize
3.3MB

Download
memory/4356-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4356-3-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download