f51f3c1fb71a3301e0716e9025bc063e8f1aeb7c3b1bb5570f9e159f86eb67be

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 16:08

Target

ScanDoc_pdf.exe
Size

296KB
MD5

de0a385641f08128deab9ec88a298d28
SHA1

5f51c8ce26b59ebed00f23ccc4fe696272a0bf07
SHA256

b1999a87350ef2b15e663c809ac16f2f0832ba3dcd868aefe0d36392af04da29
SHA512

8d93ba4cb7c68426b4441f2950128646fb136285ef6863f0d0c2e08c368c1174d467937a423946e95b1f5fec6213cf6127c666c143c6d5d77d932e64dd1958b2
SSDEEP

6144:Wx/MriVFI8E0P9Qsa8vJXlPqC8A8e1+uaisJPM:qFo8E0lE8h1CJA8Wai6M

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	4484	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 740	4484	ScanDoc_pdf.exe	84
PID 4484 wrote to memory of 740	4484	ScanDoc_pdf.exe	84
PID 4484 wrote to memory of 740	4484	ScanDoc_pdf.exe	84

C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe"
  2⤵
  PID:740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 1036
  2⤵
  - Program crash
  PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4484 -ip 4484
1⤵
PID:2504

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\6xvjduoucppa.dll

Filesize
11KB

MD5
5c05b7632a19f8b04717a76aae9e2659

SHA1
a4b1062e88f9170917ec5a9b251bd739f995c3c8

SHA256
b574aefc953483b2e57dca1653bfec41d14d0c0d460a0e7e778e943d4a1ce364

SHA512
eaef74792c64f675add11a6392e32e2eed47701add80ac9945301324057aa8778e9afbd3588109a578f3da1ff09000b1c80756ab9b7f6c5f5ef27dde7fb531ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse9D89.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/4484-9-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4484-10-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download