a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080

Resubmissions

09/08/2024, 17:04

09/08/2024, 09:10

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 17:04

Target
ACCEPT_014STSY529093.PDF.exe
Size 108KB
Sample240809-vlrnxstalk
SHA256 a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080
MD5 996817a2a2c9afe0a459bd0cc9a68d74
SHA1 23770e473ea88638874473b631602f437a799760
SHA512 24a7cdcaf49b9d565da4df977b084f0b94c82f33f1dd80621e649040baa85565aef9cb147036674ec57f3586e3038cdafacbdb6724e61a651c168359deda1df1
SSDEEP 3072:6dS3TaTBi6I/TPDe3R2/8fDvDySHzDed:65i7TSB2abGSH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	ACCEPT_014STSY529093.PDF.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2944	2212	ACCEPT_014STSY529093.PDF.exe	30
PID 2212 wrote to memory of 2944	2212	ACCEPT_014STSY529093.PDF.exe	30
PID 2212 wrote to memory of 2944	2212	ACCEPT_014STSY529093.PDF.exe	30
PID 2212 wrote to memory of 2944	2212	ACCEPT_014STSY529093.PDF.exe	30
PID 2212 wrote to memory of 2760	2212	ACCEPT_014STSY529093.PDF.exe	31
PID 2212 wrote to memory of 2760	2212	ACCEPT_014STSY529093.PDF.exe	31
PID 2212 wrote to memory of 2760	2212	ACCEPT_014STSY529093.PDF.exe	31
PID 2212 wrote to memory of 2760	2212	ACCEPT_014STSY529093.PDF.exe	31
PID 2212 wrote to memory of 2764	2212	ACCEPT_014STSY529093.PDF.exe	32
PID 2212 wrote to memory of 2764	2212	ACCEPT_014STSY529093.PDF.exe	32
PID 2212 wrote to memory of 2764	2212	ACCEPT_014STSY529093.PDF.exe	32
PID 2212 wrote to memory of 2764	2212	ACCEPT_014STSY529093.PDF.exe	32
PID 2212 wrote to memory of 2748	2212	ACCEPT_014STSY529093.PDF.exe	33
PID 2212 wrote to memory of 2748	2212	ACCEPT_014STSY529093.PDF.exe	33
PID 2212 wrote to memory of 2748	2212	ACCEPT_014STSY529093.PDF.exe	33
PID 2212 wrote to memory of 2748	2212	ACCEPT_014STSY529093.PDF.exe	33
PID 2212 wrote to memory of 2416	2212	ACCEPT_014STSY529093.PDF.exe	34
PID 2212 wrote to memory of 2416	2212	ACCEPT_014STSY529093.PDF.exe	34
PID 2212 wrote to memory of 2416	2212	ACCEPT_014STSY529093.PDF.exe	34
PID 2212 wrote to memory of 2416	2212	ACCEPT_014STSY529093.PDF.exe	34

C:\Users\Admin\AppData\Local\Temp\ACCEPT_014STSY529093.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\ACCEPT_014STSY529093.PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2416

memory/2212-0-0x000007FEF5103000-0x000007FEF5104000-memory.dmp

Download

memory/2212-1-0x0000000000A30000-0x0000000000A50000-memory.dmp

Download

memory/2212-2-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Download

memory/2212-3-0x0000000000430000-0x000000000043A000-memory.dmp

Download

memory/2212-4-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Download